CVE-2026-44377

CRITICAL 9.1

CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE

CVSS Score

9.1

EPSS Score

0.0%

EPSS Percentile

0th

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates and Documents). The application unsafely evaluates user-supplied input directly through the Smarty template engine. By leveraging this, an authenticated attacker with administrative privileges can bypass current restrictions and call native PHP functions within the templates, such as readgzfile() to read sensitive configuration files, or error_log() to write a malicious PHP web shell, ultimately achieving Information Disclosure and full Remote Code Execution (RCE). This vulnerability is fixed in 6.7.0.

CWE	CWE-94 CWE-1336
Vendor	cubecart
Product	v6
Published	May 13, 2026

Stay Ahead of the Next One

Get instant alerts for cubecart v6

Be the first to know when new critical vulnerabilities affecting cubecart v6 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

cubecart / v6

< 6.7.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/cubecart/v6/security/advisories/GHSA-wpjx-g695-qc5j github.com: https://github.com/cubecart/v6/commit/76d783c8c4d87a8a90dbfef1344a2733e7c6434c