CVE-2026-18412

OpenCart v4.2.0.0 extension installer extracts .ocmod.zip files without validating that extracted paths stay inside the target directory, allowing directory traversal. An attacker could craft a malicious extension to write files (e.g., PHP web shells) into the webroot. No additional remediation d...