CVE-2026-45708 PUBLISHED

CubeCart: Authenticated RCE via Invoice Template → Order Print

Assigner: GitHub_M
Reserved: 13.05.2026 Published: 13.05.2026 Updated: 13.05.2026

CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print.<md5>.php. files/.htaccess ships an explicit <Files print.*.php> allow from all </Files> carve-out, so the file is fetched and executed by any unauthenticated visitor. This vulnerability is fixed in 6.7.3.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.2

Product Status

Vendor cubecart
Product v6
Versions
  • Version < 6.7.3 is affected

References

Problem Types

  • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE