CVE-2026-45714: RCE in CubeCart v6 Ecommerce
Plattform
php
Komponente
cubecart-v6
Behoben in
6.7.0
CVE-2026-45714 describes a Remote Code Execution (RCE) vulnerability affecting CubeCart v6, an e-commerce software solution. This vulnerability arises from an Authenticated Server-Side Template Injection (SSTI) flaw within multiple modules. Versions 6.0.0 through 6.6.9 are affected, and the vulnerability is resolved in version 6.7.0.
Auswirkungen und Angriffsszenarien
This RCE vulnerability allows an authenticated administrator to execute arbitrary operating system commands on the server hosting the CubeCart instance. Successful exploitation grants the attacker complete control over the server, enabling them to steal sensitive data (customer information, payment details, database credentials), install malware, modify website content, or even pivot to other systems on the network. The potential for data exfiltration and system compromise is extremely high. This vulnerability shares similarities with other SSTI exploits, potentially leading to rapid exploitation if a public proof-of-concept is released.
Ausnutzungskontext
CVE-2026-45714 was published on 2026-05-13. Its CVSS score of 9.1 indicates a CRITICAL severity and a high probability of exploitation. The presence of an SSTI vulnerability, combined with the ability for authenticated administrators to exploit it, makes this a particularly concerning vulnerability. Monitor security advisories and threat intelligence feeds for any signs of active exploitation. No public exploits are currently known.
Bedrohungsanalyse
Exploit-Status
CVSS-Vektor
Was bedeuten diese Metriken?
- Attack Vector
- Netzwerk — aus der Ferne über das Internet ausnutzbar. Kein physischer oder lokaler Zugriff erforderlich.
- Attack Complexity
- Niedrig — keine besonderen Bedingungen erforderlich. Zuverlässig ausnutzbar.
- Privileges Required
- Hoch — Administrator- oder Privilegienkonto erforderlich.
- User Interaction
- Keine — automatischer und lautloser Angriff. Das Opfer tut nichts.
- Scope
- Geändert — Angriff kann über die anfällige Komponente hinaus auf andere Systeme übergreifen.
- Confidentiality
- Hoch — vollständiger Vertraulichkeitsverlust. Angreifer kann alle Daten lesen.
- Integrity
- Hoch — Angreifer kann beliebige Daten schreiben, ändern oder löschen.
- Availability
- Hoch — vollständiger Absturz oder Ressourcenerschöpfung. Totaler Denial of Service.
Betroffene Software
Schwachstellen-Klassifikation (CWE)
Zeitleiste
- Reserviert
- Veröffentlicht
Mitigation und Workarounds
The immediate mitigation is to upgrade CubeCart v6 to version 6.7.0 or later. If upgrading is not possible, restrict administrative access to the CubeCart system and implement strict input validation on all user-supplied data. Consider using a Web Application Firewall (WAF) with template injection protection rules. Regularly scan the CubeCart installation for suspicious files or processes. While not a complete solution, these measures can reduce the attack surface.
So behebenwird übersetzt…
Actualice CubeCart a la versión 6.7.0 o superior para mitigar la vulnerabilidad de inyección de plantillas del lado del servidor (SSTI). Esta actualización corrige la forma en que se evalúan las plantillas Smarty, evitando la ejecución de comandos arbitrarios en el sistema.
Häufig gestellte Fragen
What is CVE-2026-45714 — RCE in CubeCart v6 Ecommerce?
CVE-2026-45714 is a critical Remote Code Execution (RCE) vulnerability in CubeCart v6 allowing authenticated admins to execute arbitrary OS commands via SSTI.
Am I affected by CVE-2026-45714 in CubeCart v6?
If you are running CubeCart v6 versions 6.0.0 through 6.6.9, you are affected by this vulnerability. Upgrade to 6.7.0 immediately.
How do I fix CVE-2026-45714 in CubeCart v6?
The fix is to upgrade CubeCart v6 to version 6.7.0 or later. Implement WAF rules and restrict admin access as interim measures.
Is CVE-2026-45714 being actively exploited?
No active exploitation has been reported at this time, but the vulnerability's nature suggests a potential for rapid exploitation.
Where can I find the official CubeCart advisory for CVE-2026-45714?
Refer to the official CubeCart security advisories on their website: [https://www.cubecart.com/security/](https://www.cubecart.com/security/)
Ist dein Projekt betroffen?
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Jetzt testen — kein Konto
Laden Sie ein Manifest hoch (composer.lock, package-lock.json, WordPress Plugin-Liste…) oder fügen Sie Ihre Komponentenliste ein. Sie erhalten sofort einen Schwachstellenbericht. Das Hochladen einer Datei ist nur der Anfang: Mit einem Konto erhalten Sie kontinuierliche Überwachung, Slack/email-Benachrichtigungen, Multi-Projekt- und White-Label-Berichte.
Abhängigkeitsdatei hier ablegen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...