Arbitrary PHP file creation via backup filename

Arbitrary file creation in OpenCart 4.0.0.0 and later allows remote authenticated users with admin privileges to write PHP backup files. The upload route decodes an attacker-controlled filename into the oc_upload table, while the backup controller accepts any basename and writes serialized table rows to that file under the storage backup directory. Exploitation requires administrator upload and backup permissions; recommended deployments place storage outside the web root, limiting direct PHP execution.