CVE Intelligence
Analysis AI-assisted

CVE-2026-44377: CubeCart: Authenticated SSTI in Smarty Templates Leading to RCE

CVE-2026-44377 affects CubeCart versions before 6.7.0. An authenticated administrator can abuse a server-side template injection in the Smarty engine to reach sensitive data and execute code on the server. The description states the issue is fixed in 6.7.0, and the record lists a CVSS 3.1 base score of 9.1.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CubeCart is an ecommerce software platform. CVE-2026-44377 describes an authenticated server-side template injection in the Smarty template engine, reachable through several modules including email templates and documents. The GitHub advisory and the record state that the issue is fixed in version 6.7.0.

Impact

  • Information disclosure, as sensitive configuration files could be read through the template engine.
  • Remote code execution on the server, as described in the record, which classifies the weakness as CWE-94 Code Injection.

The record gives a CVSS 3.1 base score of 9.1 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. In our reading, the high privileges required and the scope change are the main factors that keep the score high despite the need for authentication.

Affected products and versions

  • CubeCart version 6 before 6.7.0.
  • The structured fields of the record contain no separate list of fixed versions. The fixed version 6.7.0 is taken from the description.

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed exploitation appears in the sources consulted. The SSVC field in the record shows a proof-of-concept state and is marked as not automatable. These fields are risk indicators and do not confirm attacks in the wild. The EPSS probability in the record is 0.00956 with a percentile of 0.60432.

Remediation and mitigation

  • Upgrade CubeCart to version 6.7.0 or later, following the vendor advisory.
  • Limit administrative accounts to trusted personnel, enforce strong authentication and review the list of administrative users.
  • Review recent changes to email templates, documents and other customizable templates for unexpected content.
  • Restrict access to the administrative interface where operationally possible.

Detection guidance

  • Review administrative activity logs for unexpected template edits or configuration changes.
  • Look for new or recently modified PHP files in web-accessible directories.
  • Monitor web server logs for unusual activity against administrative template features.

Limitations of the available information

The record does not include a structured list of fixed versions, patch details or the exact list of affected modules beyond those named in the description. The reference to the commit is listed, but its contents are not summarized here. The record source status is Deferred, so additional CNA information may appear later.

Frequently asked questions

Which CubeCart versions are affected by CVE-2026-44377?

The record lists CubeCart version 6 before 6.7.0 as affected. The description states the issue is fixed in 6.7.0.

Does this CVE require authentication?

Yes. The description says the attacker must be authenticated with administrative privileges, and the CVSS vector shows high privileges required.

Is this CVE listed as actively exploited?

No. The CISA KEV field in the record is false, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.