---
id: CVE-2026-18412
title: OpenCart extensions are uploaded as zip files with .ocmod.zip extensions
summary: >-
  OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon
  installation, the OpenCart v4.2.0.0 extension installer extracts these zip
  files, but does not validate that the extracted paths stay inside the intended
  extr…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
published: '2026-08-10'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T14:07:24.140'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18412'
references:
  - url: 'https://kb.cert.org/vuls/id/614868'
    label: cret@cert.org
  - url: 'https://www.kb.cert.org/vuls/id/614868'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00537
epssPercentile: 0.42829
ingestedAt: '2026-09-08T15:33:26.952Z'
---

## Overview

OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extension containing file path traversal sequences, such as ../. With this vulnerability, an attacker can write files, such as a PHP web shell, into the webroot directory.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.