The OpenCart v4.2.0.0 extension installer extracts uploaded ZIP package contents without ensuring that extraction paths stay within the intended directory. An attacker can embed traversal sequences, such as '..\', in a malicious extension file. When the installer processes the payload, it will create files outside the extension directory, including the webroot, allowing the attacker to place a PHP web shell and then execute arbitrary code on the server.

OpenCart software, version 4.2.0.0. No other versions are explicitly listed as affected, so the issue applies only to this specific release.

The likely attack vector is uploading a crafted extension through the extension upload interface, which requires privileged or administrative access. The CVSS score is 9.1, indicating a high severity, while the EPSS score of less than 1% reflects a low probability of exploitation in the general population. The vulnerability allows writing executable files the webroot, which can lead to full site compromise. The CISA KEV catalog does not list this vulnerability, yet the potential impact is significant enough to warrant immediate attention.