CVE-2026-3714 OpenCart Incomplete Fix CVE-2024-36694 template.php save special elements used in a template engine

Medium 5.1 Published 8 Mar 2026 Updated 11 Mar 2026

Remote attackers can execute arbitrary code via template injection in OpenCart's admin template saving function due to improper neutralization of special elements.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-3714?

CVE-2026-3714 is a medium-severity code injection vulnerability in OpenCart, published on 8 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability has been found in OpenCart 4.0.2.3. Affected by this issue is the function Save of the file admin/controller/design/template.php of the component Incomplete Fix CVE-2024-36694. Such manipulation leads to improper neutralization of special elements used in a template engine. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.

Weakness: CWE-791, CWE-1336

Which versions are affected by CVE-2026-3714?

It affects 1 product.

Products include Opencart Opencart.

How do I fix CVE-2026-3714?

No fix has been published for CVE-2026-3714 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-3714 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-3714 exists.

Sources

Also known as GHSA-6j4x-4j9g-2875.