CVE Intelligence
Analysis AI-assisted

CVE-2026-45714: CubeCart Server-Side Template Injection Leading to OS Command Execution

CubeCart versions prior to 6.7.0 contain an authenticated server-side template injection flaw in several modules, including email templates, invoices, documents and contact forms. User-supplied input is evaluated by the Smarty template engine without Smarty Security Policies enabled, which can allow an administrator-level user to run operating system commands on the server. The description states the issue is fixed in 6.7.0, and the GitHub advisory rates it 9.1 (critical) under CVSS 3.1.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-45714 affects CubeCart, an ecommerce software product. According to the record, versions before 6.7.0 are affected by an authenticated server-side template injection (SSTI) issue in several administrative modules, including Email Templates, Invoices, Documents and Contact Forms. The weakness is classified as CWE-94 (Code Injection) in the record. The primary advisory is available in the GitHub Security Advisory GHSA-pcfr-xgc9-xfv6.

Impact

  • The record describes the issue as allowing an authenticated user with administrative privileges to execute arbitrary operating system commands on the server (remote code execution).
  • The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, with a base score of 9.1 provided by the GitHub CNA. The vector reflects a network attack that requires high privileges and no user interaction, with a scope change and high impact on confidentiality, integrity and availability.
  • The root cause described is that Smarty is used to evaluate user-supplied input without its security policies enabled.

Affected products and versions

  • Product: CubeCart (ecommerce software).
  • Affected range stated in the record: prior to 6.7.0.
  • Fixed version stated in the record: 6.7.0.
  • The structured affected and fixes fields in the record are empty, so the description is the only source for the version boundary in this analysis.

Exploitation status

  • The record shows the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
  • No confirmed exploitation in the wild appears in the sources consulted for this analysis.
  • The EPSS probability in the record is 0.0054 (percentile 0.43879), which estimates likelihood of exploitation activity but is not confirmation of it.

Remediation and mitigation

  • Upgrade CubeCart installations to version 6.7.0 or later, as stated in the record.
  • Restrict administrative accounts to trusted personnel, enforce strong authentication such as multi-factor authentication, and remove unused administrator accounts.
  • Review who can edit email templates, invoice and document templates, and contact form content, since these are the modules named in the record.
  • Limit the blast radius of a compromised web application by running it with least-privilege operating system accounts and restricting outbound network access where feasible.
  • Verify the vendor advisory for any additional guidance before and after upgrading.

Detection guidance

  • Audit administrative changes to template-related settings and content, looking for unexpected modifications to email, invoice, document or contact form templates.
  • Monitor the web server for child processes spawned by the PHP or web application runtime, which would be unusual for normal store operation.
  • Review administrator login activity for unfamiliar accounts, unusual hours or unexpected source addresses.
  • Correlate application logs with system logs to identify unexpected file changes or outbound connections originating from the web server.

Limitations of the available information

  • The record does not list affected or fixed version strings in structured fields; the version boundary relies on the description text.
  • The record does not include a proof of concept, a detailed technical write-up or vendor-supplied exploitation details, and this analysis does not provide any.
  • The EPSS date in the record (2026-10-13) is later than the publication date (2026-05-13), so the EPSS values should be re-checked against the current feed.
  • The CVSS score is provided by the GitHub CNA; no NVD-assigned score is present in the record.
  • The record title field was empty and the title in this analysis was written from the description.

Frequently asked questions

Which CubeCart versions are affected by CVE-2026-45714?

The record states that versions prior to 6.7.0 are affected. The structured affected-versions field is empty, so the description is the only source for this boundary.

What is the fix for CVE-2026-45714?

The record states the vulnerability is fixed in CubeCart 6.7.0. Administrators should upgrade to that version or later.

Is CVE-2026-45714 known to be actively exploited?

No. The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted for this analysis.

Who can exploit this vulnerability?

According to the record, the attacker must be authenticated with administrative privileges, which is reflected in the high privileges value of the CVSS vector.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.