CVE-2026-45053: RCE in CubeCart v6 Ecommerce Software
Platform
php
Component
cubecart-v6
Fixed in
6.7.0
CVE-2026-45053 describes a critical Remote Code Execution (RCE) vulnerability discovered in CubeCart v6, a popular ecommerce software solution. This flaw allows authenticated attackers to upload and execute arbitrary PHP code, potentially leading to complete system takeover. The vulnerability impacts versions 6.0.0 through 6.6.9, and a patch is available in version 6.7.0.
Impact and Attack Scenarios
The impact of this vulnerability is severe. An attacker with valid API credentials and the files:rw permission can leverage the REST API File Manager endpoint to upload malicious PHP files. The combination of arbitrary file upload and a path traversal vulnerability allows the attacker to write a webshell anywhere the webserver process can write, including the document root. This grants the attacker full remote code execution capabilities, enabling them to modify files, steal sensitive data (customer information, payment details, database credentials), install malware, and potentially pivot to other systems on the network. Successful exploitation could result in a complete compromise of the ecommerce platform and associated data, mirroring the impact of similar webshell vulnerabilities in other platforms.
Exploitation Context
CVE-2026-45053 was published on May 13, 2026. Its CVSS score of 9.1 (CRITICAL) reflects the high likelihood of exploitation and significant impact. Currently, there are no publicly known active campaigns targeting this vulnerability, but the availability of a straightforward exploit path makes it a likely target. The vulnerability is not listed on KEV (Known Exploited Vulnerabilities) as of this writing, but its severity warrants close monitoring. Exploitation would likely follow a similar pattern to other webshell vulnerabilities, involving the upload of a PHP webshell and subsequent use to execute commands on the server.
Threat Intelligence
Exploit Status
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- High — admin or privileged account required to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Changed — successful attack can pivot beyond the vulnerable component to other systems or the host OS.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- High — attacker can write, modify, or delete any data: databases, config files, or code.
- Availability
- High — complete crash or resource exhaustion. Full denial of service.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
Mitigation and Workarounds
The primary mitigation is to immediately upgrade CubeCart to version 6.7.0, which addresses this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict API key permissions to the minimum necessary. Implement strict input validation and sanitization on the filepath parameter in the REST API File Manager endpoint. Deploy a Web Application Firewall (WAF) with rules to detect and block suspicious file uploads, particularly those containing PHP code. Monitor web server logs for unusual file creation or modification activity in the images/source/ directory. After upgrading, verify the fix by attempting to upload a test PHP file with a benign payload through the API endpoint; it should be rejected.
How to fix
Actualice CubeCart a la versión 6.7.0 o posterior para mitigar la vulnerabilidad de carga arbitraria de archivos. Esta actualización corrige la falla de seguridad al restringir la capacidad de subir archivos PHP maliciosos a través de la API REST.
Frequently asked questions
What is CVE-2026-45053 — RCE in CubeCart v6?
CVE-2026-45053 is a critical Remote Code Execution vulnerability in CubeCart v6 ecommerce software, allowing authenticated attackers to upload and execute malicious PHP code.
Am I affected by CVE-2026-45053 in CubeCart v6?
You are affected if you are running CubeCart v6 versions 6.0.0 through 6.6.9. Upgrade to version 6.7.0 to resolve the vulnerability.
How do I fix CVE-2026-45053 in CubeCart v6?
The recommended fix is to upgrade to CubeCart version 6.7.0. Temporary workarounds include restricting API key permissions and implementing WAF rules.
Is CVE-2026-45053 being actively exploited?
While there are no currently known active campaigns, the vulnerability's severity and ease of exploitation make it a likely target. Continuous monitoring is advised.
Where can I find the official CubeCart advisory for CVE-2026-45053?
Refer to the official CubeCart security advisory on their website or GitHub repository for the most up-to-date information and patch details.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...