PT-2026-40815 · Cubecart+1 · Cubecart+1

Published 2026-05-13 · Updated 2026-05-14 · CVE-2026-45714

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.0

Description An Authenticated Server-Side Template Injection (SSTI) exists in multiple modules, including Email Templates, Invoices, Documents, and Contact Forms. The application unsafely evaluates user-supplied input using the Smarty template engine without enabling Smarty Security Policies. This allows an authenticated user with administrative privileges to execute arbitrary operating system commands (Remote Code Execution) on the server.

Recommendations Update to version 6.7.0.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

CWE-1336

Related Identifiers

CVE-2026-45714

Affected Products

Cubecart

Smarty

References · 4

• 🔥 https://github.com/cubecart/v6/security/advisories/GHSA-pcfr-xgc9-xfv6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45714 · Security Note
• https://twitter.com/CVEnew/status/2054709212748689786 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2054842385339732271 · Twitter Post