CVE-2026-45053: RCE in CubeCart v6 Ecommerce Platform

The impact of this vulnerability is severe. An attacker with valid API credentials and the 'files:rw' permission can leverage the REST API File Manager endpoint to upload malicious PHP scripts. The combination of arbitrary file upload and a path traversal vulnerability allows the attacker to write a webshell anywhere the webserver process has write access, including the document root. This effectively grants the attacker full remote code execution capabilities, enabling them to modify files, steal sensitive data (customer information, payment details, database credentials), install malware, and potentially pivot to other systems on the network. The ability to execute arbitrary code represents a significant security risk, potentially leading to data breaches, financial losses, and reputational damage.

1. Reserviert2026-05-08
2. Veröffentlicht2026-05-13

The primary mitigation is to immediately upgrade CubeCart to version 6.7.0, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict API key permissions to the minimum necessary; avoid granting 'files:rw' unless absolutely required. Implement a Web Application Firewall (WAF) with rules to block suspicious file uploads, particularly those with PHP extensions. Monitor the 'images/source/' directory for unexpected files and regularly scan the system for malicious code. After upgrading, verify the fix by attempting to upload a test PHP file through the REST API with an API key possessing 'files:rw' permission; the upload should be rejected.