CVE-2026-54645 Details
Description
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, description_short, and spec_copy rich-text fields from $GLOBALS['RAW']['POST'] and removes only script elements before the values are stored and rendered through Smarty templates. An administrator with product-editing rights can store event-handler attributes, SVG content, or javascript: URIs that bypass this filter, causing persistent JavaScript execution when a storefront visitor or another administrator views the product content and enabling session exposure or unauthorized browser-context actions. This issue is fixed in version 6.7.5.
A stored cross-site scripting vulnerability has been identified in CubeCart versions prior to 6.7.5. The issue arises in the product management panel, where the application bypasses global input sanitization for rich-text fields, allowing the injection of malicious scripts. An administrator with product-editing rights can exploit this by inserting event-handler attributes, SVG content, or 'javascript:' URIs that evade the limited script tag filter. These injections are executed persistently when the product is viewed, potentially leading to session hijacking or unauthorized actions in the browser context.
Users can update to CubeCart version 6.7.5, which addresses this vulnerability by implementing a proper HTML sanitization that removes scripts, event handlers, and unsafe URI schemes while preserving safe formatting.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cubecart/v6/security/advisories/GHSA-43f6-gfcf-wj9c | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php | [email protected] | Release NotesVendor |
| https://github.com/cubecart/v6/commit/bd2dcdcc7da55a3731fe288b54cac8bfa3d9142a | [email protected] | Source CodeVendor |
| https://github.com/cubecart/v6/commit/f7abe7484691a33abcbc0806fca59d605024a75c | [email protected] | Source CodeVendor |
| https://github.com/cubecart/v6/releases/tag/6.7.5 | [email protected] | Release NotesVendor |
| https://github.com/cubecart/v6/security/advisories/GHSA-43f6-gfcf-wj9c | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CubeCart | 6.7.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |