What’s Vulnerable › Vulnerabilities

CVE-2026-45714: CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-13 · updated 2026-06-17
• Weakness: CWE-94

Description

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates, Invoices, Documents, and Contact Forms). The application unsafely evaluates user-supplied input using the Smarty template engine without enabling Smarty Security Policies. This allows any authenticated user with administrative privileges to execute arbitrary operating system commands (RCE) on the server. This vulnerability is fixed in 6.7.0.

Affected products

• cubecart v6: before 6.7.0

References

• https://github.com/cubecart/v6/security/advisories/GHSA-pcfr-xgc9-xfv6
• https://github.com/cubecart/v6/security/advisories/GHSA-pcfr-xgc9-xfv6

Get alerted when CVE-2026-45714 or the next vulnerability affects your stack