PT-2026-3929 · Unknown · Quick.Cart

Arkadiusz Marta · Published 2026-01-22 · Updated 2026-02-19 · CVE-2025-67684

Positive Technologies · (AI Summary)

CVSS v4.0

9.4

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Quick.Cart version 6.7 Quick.Cart (affected versions not specified)

Description Quick.Cart is susceptible to Local File Inclusion and Path Traversal issues within its theme selection process. A user with sufficient privileges can upload arbitrary file content, with validation limited to the filename extension. This allows an attacker to include and execute uploaded PHP code, potentially leading to Remote Code Execution on the server. The vendor was contacted regarding this issue but did not provide details about vulnerable versions or a response. The API endpoint involved in theme selection is not specified. The vulnerable parameter is not specified. The vulnerable function is not specified.

Recommendations Quick.Cart version 6.7 should be updated when a fix becomes available. For all other affected versions, update when a fix becomes available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-67684

Affected Products

Quick.Cart

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-67684 · Security Note
• https://twitter.com/VulmonFeeds/status/2014417571995439120 · Twitter Post
• https://opensolution.org/sklep-internetowy-quick-cart.html · Note
• https://t.me/cveNotify/152490 · Telegram Post
• https://twitter.com/0dayPublishing/status/2014309872750170184 · Twitter Post
• https://t.me/cveNotify/149528 · Telegram Post
• https://twitter.com/CVEnew/status/2014316513784979574 · Twitter Post
• https://cert.pl/posts/2026/01/CVE-2025-67683 · Note
• https://t.me/CVEtracker/42775 · Telegram Post
• https://twitter.com/lsof/status/2014399452253954426 · Twitter Post