CVE Intelligence
Analysis AI-assisted

CVE-2026-45053: CubeCart REST API File Manager: authenticated arbitrary file upload

CubeCart versions prior to 6.7.0 contain an authenticated arbitrary file upload flaw in the REST API File Manager endpoint, which can place PHP files in a web-accessible directory. The record links this to a path-traversal weakness and describes the outcome as full remote code execution, with a CVSS 3.1 base score of 9.1. The issue is stated to be fixed in 6.7.0, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CubeCart is an ecommerce software solution. According to the GitHub Security Advisory referenced in the record, versions prior to 6.7.0 contain an authenticated arbitrary file upload vulnerability in the REST API File Manager endpoint. The weakness is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), and the record states it is fixed in 6.7.0.

Impact

  • Holders of an API key with the files:rw permission can upload PHP source files into the web-accessible images/source/ directory.
  • A path-traversal weakness in the filepath parameter of the same endpoint is reported to extend where files can be written.
  • The record describes the combined result as full remote code execution through the web server process.
  • The CVSS 3.1 base score recorded is 9.1 (critical), with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products and versions

  • Product: CubeCart (ecommerce software).
  • Affected: versions prior to 6.7.0, as stated in the record description.
  • Fixed: 6.7.0, as stated in the record description.
  • The structured affected and fixes lists in the record are empty, so version information comes only from the description text.

Exploitation status

The CVE is not listed in the CISA KEV catalog according to the record. No confirmed exploitation in the wild appears in the sources consulted. The record includes an EPSS probability of 0.00761 and a percentile of 0.54126.

Remediation and mitigation

  • Upgrade CubeCart to version 6.7.0 or later.
  • Review API keys, remove the files:rw permission where it is not needed, and rotate any key that may have been exposed.
  • Restrict access to the API to trusted networks where this is operationally feasible.
  • Audit the images/source/ directory and the web root for unexpected PHP files, and review web server logs for requests to them.

Detection guidance

  • Look for newly created PHP files in upload-capable directories, especially images/source/, that do not correspond to normal administrative activity.
  • Review API logs for file management requests from unexpected keys or source addresses.
  • Monitor web server logs for requests to unfamiliar scripts located in writable directories.

Limitations of the available information

  • The record does not include structured affected version ranges or fix lists.
  • The record does not provide technical details beyond the description, and no exploitation evidence was found in the sources consulted.
  • The record's source status is Deferred, and the EPSS date in the record is later than the publication date, so current details should be checked in the GitHub advisory and vendor notes.

Frequently asked questions

Which CubeCart versions are affected by CVE-2026-45053?

According to the record description, versions prior to 6.7.0 are affected. The structured affected products list in the record is empty.

Is the fix available?

The record states the vulnerability is fixed in 6.7.0. Upgrading to that version or later is the recommended remediation.

Is this vulnerability known to be actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.