PT-2026-40814 · Cubecart · Cubecart

Published 2026-05-13 · Updated 2026-05-14 · CVE-2026-45708

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.3

Description An administrator with documents edit permission can save raw PHP code into the Invoice Editor. When any administrator clicks Print on an order, the rendered template is written to files/print.<md5>.php. Due to an explicit carve-out in the files/.htaccess file that allows all access to print.*.php files, the file can be fetched and executed by any unauthenticated visitor.

Recommendations Update to version 6.7.3.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-45708

Affected Products

Cubecart

References · 4

• 🔥 https://github.com/cubecart/v6/security/advisories/GHSA-747j-4mmc-cj63 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45708 · Security Note
• https://twitter.com/CVEnew/status/2054709210437562627 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2054850064716034302 · Twitter Post