A critical path traversal vulnerability in OpenCart allows unauthenticated remote attackers to achieve arbitrary file upload and potential remote code execution.

The vulnerability exists in the extension installer, which fails to validate the destination paths of extracted .ocmod.zip files. This allows an unauthenticated attacker to use path traversal sequences to bypass directory restrictions and write malicious files into the webroot.

Successful exploitation allows an attacker to upload and execute arbitrary PHP code on the server, leading to a full compromise of the application and underlying host. Given the CVSS score of 9.1, this vulnerability poses a severe risk of data theft, unauthorized system access, and potential lateral movement within the network. Immediate remediation is required to prevent total service takeover.

Immediate Action: Restrict access to the extension installation functionality and monitor for any unauthorized extension uploads until an official patch is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the extension installer or the creation of unexpected files in the webroot directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block incoming POST requests containing path traversal sequences, such as dot-dot-slash patterns, directed at the extension management endpoints.

Public Exploit Available: No

The severity of this flaw cannot be overstated, as it provides a direct path to remote code execution for unauthenticated actors. Security teams must prioritize restricting administrative access to the installer module and maintain a vigilant watch for vendor updates. Apply the official patch as soon as it becomes available to remediate this critical risk.