CVE-2026-84438

The OpenCart v4.2.0.0 extension installer does not validate that extracted paths stay within the intended directory. An attacker can craft a malicious extension with path traversal sequences to write files, such as a PHP web shell, into the webroot.

OpenCart version 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie. Attackers can set malicious OCSESSID cookie values that the server accepts and maintains, enabling session takeover and unauthorized access to user accounts.

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address_1 results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

OpenCart 3.0.3.7 contains a cross-site request forgery vulnerability that allows attackers to change user passwords by sending crafted requests to the account/password endpoint. Attackers can trick authenticated users into submitting hidden forms with new password values in the 'password' and 'confirm' parameters to hijack accounts.

OpenCart 3.0.3.6 has a cross-site request forgery vulnerability in the /account/edit endpoint, allowing unauthenticated attackers to modify victim account details by tricking users into visiting malicious pages. Attackers can change email addresses and use password reset to take over accounts.