CVE-2026-45055: SSRF in CubeCart v6 Ecommerce Software
Platform
php
Component
cubecart
Fixed in
6.7.2
CVE-2026-45055 is a Server-Side Request Forgery (SSRF) vulnerability affecting CubeCart v6 versions 6.6.0 through 6.7.1. An attacker can exploit this flaw to craft malicious password reset links, potentially leading to account takeover. The vulnerability stems from the improper handling of the Host header during bootstrap, which is then embedded directly into transactional email links. A fix is available in CubeCart version 6.7.2.
Impact and Attack Scenarios
The primary impact of this SSRF vulnerability lies in the ability of an unauthenticated attacker to manipulate password reset links. By crafting a malicious Host header, an attacker can redirect the password reset link to an attacker-controlled domain. When a user clicks this link, they are prompted to enter a new password on the attacker's site, effectively granting the attacker control of the user's account. This could lead to data theft, fraudulent transactions, or further compromise of the ecommerce platform. The vulnerability's impact is amplified by the fact that it targets a critical function – password recovery – which is often used by legitimate users, increasing the likelihood of exploitation. This attack pattern shares similarities with other SSRF-based phishing campaigns, where attackers leverage trusted domains to trick users into divulging credentials.
Exploitation Context
CVE-2026-45055 was published on May 13, 2026. Currently, there are no public exploit code or active campaigns targeting this vulnerability. The CVSS score of 8.1 (HIGH) indicates a significant risk, and it is likely to be added to KEV (Known Exploited Vulnerabilities) lists if exploitation becomes widespread. Monitor security advisories and threat intelligence feeds for updates.
Threat Intelligence
Exploit Status
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- None — unauthenticated. No login or credentials needed to exploit.
- User Interaction
- Required — victim must take an action: open a file, click a link, or visit a crafted page.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- High — attacker can write, modify, or delete any data: databases, config files, or code.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
- Modified
Mitigation and Workarounds
The primary mitigation for CVE-2026-45055 is to immediately upgrade CubeCart to version 6.7.2 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests with suspicious Host headers. Specifically, block requests where the Host header contains unexpected or malicious domains. Additionally, review CubeCart's configuration to ensure that any custom settings related to email sending are secure and do not introduce similar vulnerabilities. After upgrading, confirm the fix by attempting to trigger a password reset and verifying that the generated link points to the correct CubeCart domain.
How to fix
Actualice CubeCart a la versión 6.7.2 o superior para mitigar la vulnerabilidad de envenenamiento de enlaces de restablecimiento de contraseña. La versión corregida valida el Host request header, previniendo la inyección de dominios maliciosos en los enlaces de restablecimiento de contraseña.
Frequently asked questions
What is CVE-2026-45055 — SSRF in CubeCart v6?
CVE-2026-45055 is a Server-Side Request Forgery vulnerability in CubeCart v6 (versions 6.6.0–6.7.1) that allows attackers to manipulate password reset links, potentially leading to account takeover.
Am I affected by CVE-2026-45055 in CubeCart v6?
If you are running CubeCart v6 versions 6.6.0 through 6.7.1, you are vulnerable to this SSRF attack. Upgrade to version 6.7.2 or later to mitigate the risk.
How do I fix CVE-2026-45055 in CubeCart v6?
The recommended fix is to upgrade CubeCart to version 6.7.2 or later. As a temporary workaround, implement a WAF rule to block requests with suspicious Host headers.
Is CVE-2026-45055 being actively exploited?
As of the publication date, there are no reports of active exploitation. However, the vulnerability's severity warrants immediate attention and mitigation.
Where can I find the official CubeCart advisory for CVE-2026-45055?
Refer to the official CubeCart security advisory on their website or GitHub repository for detailed information and updates regarding CVE-2026-45055.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...