PT-2026-40806 · Cubecart · Cubecart

Published 2026-05-13 · Updated 2026-05-13 · CVE-2026-44377

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.0

Description An Authenticated Server-Side Template Injection (SSTI) exists in multiple modules, including Email Templates and Documents. The application unsafely evaluates user-supplied input through the Smarty template engine. An authenticated attacker with administrative privileges can bypass restrictions to call native PHP functions within templates, such as readgzfile() to read sensitive configuration files or error log() to write a malicious PHP web shell, leading to Information Disclosure and Remote Code Execution (RCE).

Recommendations Update to version 6.7.0.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

CWE-1336

Related Identifiers

CVE-2026-44377

Affected Products

Cubecart

References · 4

• 🔥 https://github.com/cubecart/v6/security/advisories/GHSA-wpjx-g695-qc5j · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44377 · Security Note
• https://github.com/cubecart/v6/commit/76d783c8c4d87a8a90dbfef1344a2733e7c6434c · Note
• https://twitter.com/CVEnew/status/2054709219669245967 · Twitter Post