A path traversal vulnerability exists in the installer.php script of the Extension Installer page in OpenCart 4.1.0.3. The flaw allows an attacker to supply a crafted request that causes the application to resolve a file path outside the intended directory. This results in the ability to read files on the server that are not meant to be exposed, potentially exposing configuration files, credentials, or other sensitive data. The likely impact is disclosure of confidential information beyond the scope of the user’s privileges.

The affected product is OpenCart, specifically the 4.1.0.3 release of the Extension Installer component. No other versions or products are explicitly listed as affected.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not a widely exploited or high‑profile issue. The attack can be launched remotely by sending a crafted request to installer.php. There is no official patch or upgrade path provided by the vendor in the supplied data, so exploitation remains feasible until a fix is released. The potential damage is primarily the unauthorized disclosure of files, which could lead to further compromise if sensitive credentials are exposed.