CVE-2026-45714

CRITICAL

CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE

Title source: cna
STIX 2.1

Description

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates, Invoices, Documents, and Contact Forms). The application unsafely evaluates user-supplied input using the Smarty template engine without enabling Smarty Security Policies. This allows any authenticated user with administrative privileges to execute arbitrary operating system commands (RCE) on the server. This vulnerability is fixed in 6.7.0.

References (1)

Core 1
Core References

Scores

CVSS v3 9.1
EPSS 0.0042
EPSS Percentile 32.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-1336 CWE-94
Status published
Products (1)
cubecart/v6 < 6.7.0
Published May 13, 2026
Tracked Since May 14, 2026