CVE-2026-44377: RCE in CubeCart v6 Ecommerce Software
Platform
php
Component
cubecart-v6
Fixed in
6.7.0
A critical Remote Code Execution (RCE) vulnerability (CVE-2026-44377) has been identified in CubeCart v6, an ecommerce software solution. This vulnerability stems from an Authenticated Server-Side Template Injection (SSTI) flaw within multiple modules, allowing an attacker with administrative privileges to execute arbitrary code. The vulnerability impacts versions 6.0.0 through 6.6.9, and a patch is available in version 6.7.0.
Impact and Attack Scenarios
The impact of CVE-2026-44377 is severe. An authenticated attacker, possessing administrative access to a CubeCart v6 instance, can leverage the SSTI vulnerability to bypass security restrictions and directly call native PHP functions within templates. This allows for a wide range of malicious actions, including reading sensitive configuration files (e.g., using readgzfile()) and, critically, writing malicious PHP web shells. Successful exploitation grants the attacker complete control over the affected server, enabling data theft, modification, and further lateral movement within the network. The potential for data exfiltration and system takeover is significant, mirroring the impact of other SSTI vulnerabilities like those seen in earlier template engines.
Exploitation Context
CVE-2026-44377 was published on May 13, 2026. Its severity is rated CRITICAL (CVSS 9.1). As of this writing, there are no publicly known active campaigns exploiting this vulnerability. However, the ease of exploitation and the potential for significant impact suggest that it will likely become a target for malicious actors. Public Proof-of-Concept (POC) code is anticipated to emerge, increasing the risk of exploitation. The vulnerability is not currently listed on KEV or EPSS, indicating a low to medium probability of exploitation in the short term, but this could change rapidly.
Threat Intelligence
Exploit Status
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- High — admin or privileged account required to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Changed — successful attack can pivot beyond the vulnerable component to other systems or the host OS.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- High — attacker can write, modify, or delete any data: databases, config files, or code.
- Availability
- High — complete crash or resource exhaustion. Full denial of service.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
Mitigation and Workarounds
The primary mitigation for CVE-2026-44377 is to immediately upgrade CubeCart to version 6.7.0, which contains the necessary fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. While a direct WAF rule targeting the SSTI payload is difficult to create due to the dynamic nature of template injection, strict input validation on all user-supplied data within CubeCart templates can help reduce the attack surface. Review and restrict access to sensitive configuration files to limit potential data exposure. Monitor CubeCart logs for suspicious activity, particularly attempts to execute unusual PHP functions within templates. After upgrading to 6.7.0, verify the fix by attempting to inject a simple PHP payload within a template and confirming that it is properly sanitized and does not execute.
How to fix
Actualice CubeCart a la versión 6.7.0 o posterior para mitigar la vulnerabilidad de inyección de plantillas del lado del servidor (SSTI). Esta actualización corrige la forma en que se evalúan las plantillas, evitando la ejecución de código PHP no autorizado a través de la entrada del usuario.
Frequently asked questions
What is CVE-2026-44377 — RCE in CubeCart v6?
CVE-2026-44377 is a critical Remote Code Execution (RCE) vulnerability in CubeCart v6 ecommerce software. It allows authenticated administrators to execute arbitrary PHP code through an SSTI flaw, potentially leading to full system compromise.
Am I affected by CVE-2026-44377 in CubeCart v6?
You are affected if you are running CubeCart v6 versions 6.0.0 through 6.6.9. Upgrade to version 6.7.0 to address this vulnerability.
How do I fix CVE-2026-44377 in CubeCart v6?
The recommended fix is to upgrade CubeCart to version 6.7.0. If immediate upgrade is not possible, implement temporary workarounds like strict input validation and restricting access to sensitive files.
Is CVE-2026-44377 being actively exploited?
As of the current date, there are no publicly known active campaigns exploiting CVE-2026-44377, but the vulnerability's severity and ease of exploitation suggest it may become a target.
Where can I find the official CubeCart advisory for CVE-2026-44377?
Refer to the official CubeCart security advisory for CVE-2026-44377 on the CubeCart website or their security announcement channels. (Link will be available upon official release).
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...