The OpenCart v4.2.0.0 extension installer extracts uploaded ZIP package contents without ensuring that extraction paths stay within the intended directory. An attacker can embed traversal sequences, such as '..\', in a malicious extension file. When the installer processes the payload, it will create files outside the extension directory, including the webroot, allowing the attacker to place a PHP web shell and then execute arbitrary code on the server.

OpenCart software, version 4.2.0.0. No other versions are explicitly listed as affected, so the issue applies only to this specific release.

The likely attack vector is uploading a crafted extension through the extension upload interface, which requires privileged or administrative access. No CVSS score is provided, and EPSS data is unavailable, but the ability to write executable files in the webroot can lead to full site compromise. The CISA KEV catalog does not list this vulnerability, yet the potential impact is significant enough to warrant immediate attention.