Token theft via reflected file-manager directory input

Reflected XSS in OpenCart 4.0.0.0 through 4.0.2.3 allows remote attackers to steal a user's token through a crafted admin file-manager URL. The login controller preserves untrusted route arguments in a hidden redirect field, returns that redirect with the new token after authentication, and sends the directory value to the file-manager route without safe output handling. Exploitation requires knowledge of the admin path and either a victim who follows the URL and authenticates or an already authenticated administrator; the resulting script can access the administrator's token.