CVE-2026-18412 Overview
CVE-2026-18412 is a path traversal vulnerability in the OpenCart v4.2.0.0 extension installer. OpenCart extensions ship as zip archives with .ocmod.zip extensions. The installer extracts these archives without validating that extracted paths remain within the intended extraction directory. An attacker who crafts a malicious extension containing ../ traversal sequences can write arbitrary files outside the target directory, including PHP web shells placed in the webroot.
Critical Impact
An authenticated administrator installing a malicious .ocmod.zip extension enables arbitrary file write to the webroot, leading to remote code execution through a dropped PHP web shell.
Affected Products
- OpenCart v4.2.0.0 extension installer
- OpenCart deployments accepting .ocmod.zip extensions
- Installations without additional file-write hardening
Discovery Timeline
- 2026-08-10 - CVE-2026-18412 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-18412
Vulnerability Analysis
The vulnerability is a classic Zip Slip issue [CWE-22] in the OpenCart extension installer. OpenCart accepts extensions as zip archives named with a .ocmod.zip suffix. During installation, the installer iterates over archive entries and writes each entry to disk using the archive-supplied filename. The installer does not canonicalize the destination path or verify that the resolved path stays inside the extraction directory.
Because the extraction routine trusts archive metadata, an attacker can include entries with names such as ../../../public_html/shell.php. The extractor follows these relative segments and writes the payload outside the intended directory. Writing a PHP file into the webroot yields remote code execution under the web server user.
Root Cause
The installer performs zip extraction without applying path normalization or a containment check against the target directory. A safe extractor resolves each entry to an absolute path and confirms the resolved path begins with the intended base directory before any write. The OpenCart installer omits this check.
Attack Vector
Exploitation requires an actor to deliver a malicious .ocmod.zip file to an administrator with extension-install privileges. The archive contains one or more entries whose names embed ../ sequences pointing at the webroot. When the administrator installs the extension, the installer writes attacker-controlled files to the resolved paths. The attacker then requests the dropped PHP file over the network to execute arbitrary code.
No verified public exploit is listed in the CVE record. Technical detail is available in the CERT Vulnerability Advisory #614868.
Detection Methods for CVE-2026-18412
Indicators of Compromise
- New or modified .php files in the webroot with recent timestamps that do not match any tracked deployment change.
- Presence of .ocmod.zip archives containing entries whose names include ../ or absolute path components.
- Web server access logs showing GET or POST requests to unfamiliar PHP files immediately after an extension install event.
- Extension install activity in OpenCart admin logs followed by outbound connections from the web server process.
Detection Strategies
- Inspect uploaded .ocmod.zip archives before install and reject any archive containing entries with .., leading /, or drive letters in their names.
- Monitor file integrity on the webroot and flag any PHP file creation not initiated by a controlled deployment pipeline.
- Correlate OpenCart admin extension-install events with file creation events outside the expected extension directory tree.
Monitoring Recommendations
- Enable and forward OpenCart admin activity logs to a central logging system for extension install correlation.
- Alert on process execution chains where the web server spawns shells, php CLI, or network utilities.
- Track outbound network connections initiated by the web server user to detect web shell command-and-control activity.
How to Mitigate CVE-2026-18412
Immediate Actions Required
- Restrict extension installation to a small set of trusted administrators and require multi-party approval for any .ocmod.zip upload.
- Block extension installs from untrusted sources at the web application firewall or reverse proxy.
- Audit the webroot for PHP files created since the last known-good deployment and remove any file that is not part of the OpenCart baseline.
- Rotate administrator credentials and API tokens if a suspicious extension install is identified.
Patch Information
No fixed version is listed in the NVD record at the time of publication. Consult the CERT Vulnerability Advisory #614868 for vendor coordination status and monitor OpenCart release notes for a patched build. Apply the vendor update as soon as it becomes available.
Workarounds
- Pre-scan .ocmod.zip archives with a script that rejects any entry whose normalized path escapes the extraction directory.
- Run the web server under a least-privilege account and mount the webroot as read-only where feasible, allowing writes only in a dedicated uploads directory.
- Disable the extension installer in production and stage extension installs in an isolated environment for validation before promotion.
- Enforce a Content Security Policy and web server rules that block execution of PHP files in directories that should contain only static assets.
# Example pre-install archive validation using unzip
unzip -l extension.ocmod.zip | awk '{print $4}' | grep -E '(^\.\./|/\.\./|^/)' && \
echo 'REJECT: path traversal entry detected' || \
echo 'OK: archive entries contained'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
