PT-2026-40811 · Cubecart · Cubecart

Published 2026-05-13 · Updated 2026-05-15 · CVE-2026-45053

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.0

Description An authenticated arbitrary file upload and path traversal issue exists in the REST API File Manager endpoint "POST /api/v1/files". Users possessing an API key with files:rw permission can upload PHP source files to the web-accessible images/source/ directory. By exploiting a path traversal flaw in the filepath parameter, an attacker can write a webshell to any location accessible by the webserver process, such as the document root, resulting in remote code execution.

Recommendations Update to version 6.7.0.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-45053

Affected Products

Cubecart

References · 5

• 🔥 https://github.com/cubecart/v6/security/advisories/GHSA-652f-8c88-25cx · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45053 · Security Note
• https://t.me/cveNotify/163679 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2054852624608788656 · Twitter Post
• https://twitter.com/CVEnew/status/2054709215114211404 · Twitter Post