CVE-2026-18412
Last modified
CVE-2026-18412 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extension containing file path traversal sequences, such as ../. With this vulnerability, an attacker can write files, such as a PHP web shell, into the webroot directory.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| OpenCart | OpenCart | 4.2.0.0 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-18412?
How severe is CVE-2026-18412?
How do I fix CVE-2026-18412?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-18395The Child Pages Card WordPress plugin before 1.09 does not s…5.4
- CVE-2026-1840The Aclara Metrum Cellular Web Interface is vulnerable to un…8.7
- CVE-2026-18400The Slider, Gallery, and Carousel by MetaSlider – Image Slid…6.4
- CVE-2026-18401The non-blocking (asynchronous) JSON parser in jackson-core …6.9
- CVE-2026-1841The PixelYourSite – Your smart PIXEL (TAG) & API Manager plu…7.2
- CVE-2026-18411The KARR Security System and SWDS dealer-installed automotiv…8.1
- CVE-2026-1842HyperCloud versions 2.3.5 through 2.6.8 improperly allowed r…6.2
- CVE-2026-18427@fastify/static before version 10.1.3 contains an incomplete…7.5
- CVE-2026-1843The Super Page Cache plugin for WordPress is vulnerable to S…7.2
- CVE-2026-18435The Kadence Blocks — Page Builder Toolkit for Gutenberg Edit…6.4
- CVE-2026-18436The MailPress plugin for WordPress is vulnerable to unauthor…5.3
- CVE-2026-18437The MailerPress – Newsletter, email marketing & AI automatio…5.3
Are you affected by CVE-2026-18412?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST