CVE-2026-44377 Details
Description
CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates and Documents). The application unsafely evaluates user-supplied input directly through the Smarty template engine. By leveraging this, an authenticated attacker with administrative privileges can bypass current restrictions and call native PHP functions within the templates, such as readgzfile() to read sensitive configuration files, or error_log() to write a malicious PHP web shell, ultimately achieving Information Disclosure and full Remote Code Execution (RCE). This vulnerability is fixed in 6.7.0.
A Server-Side Template Injection (SSTI) vulnerability has been identified in CubeCart versions prior to 6.7.0. This vulnerability exists in multiple modules, including Email Templates and Documents. The issue arises because the application improperly evaluates user input through the Smarty template engine. An authenticated attacker with administrative rights can exploit this flaw to bypass restrictions and execute native PHP functions within the templates. For instance, the attacker could use 'readgzfile()' to access sensitive configuration files or 'error_log()' to write a malicious PHP web shell, resulting in Information Disclosure and full Remote Code Execution (RCE).
Users are advised to update to CubeCart version 6.7.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 13, 2026CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cubecart/v6/security/advisories/GHSA-wpjx-g695-qc5j | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/cubecart/v6/commit/76d783c8c4d87a8a90dbfef1344a2733e7c6434c | [email protected] | Source CodeVendor |
| https://github.com/cubecart/v6/security/advisories/GHSA-wpjx-g695-qc5j | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CubeCart | ~6.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | New CVE Received | [email protected] |