OpenCart version 4.2.0.0 has a directory traversal vulnerability in its extension installer. This flaw allows attackers to place files anywhere on the server by exploiting how zip files are extracted. The installer extracts uploaded .zip files without validating the paths derived from the zip entry filenames. Attackers can craft malicious extensions using sequences like ../ to navigate outside the intended directory. This could enable them to write files, including a PHP web shell, into the webroot. If an administrator installs such an extension, it can lead to remote code execution with OpenCart's server privileges. The creation of a web shell further allows for system-level command execution. The vulnerability has been confirmed in version 4.2.0.0, and other 4.x versions might also be vulnerable. A patch is currently unavailable as OpenCart could not be reached for coordination. Users are advised to update to the latest version and avoid installing extensions from untrusted sources while configuring OpenCart with minimal necessary privileges.