CVE-2026-44377: RCE in CubeCart v6 Ecommerce Software

The impact of CVE-2026-44377 is severe. An authenticated attacker, possessing administrative access to a CubeCart v6 instance, can leverage the SSTI vulnerability to bypass security restrictions and directly call native PHP functions within templates. This allows for a wide range of malicious actions, including reading sensitive configuration files (e.g., using readgzfile()) and, critically, writing malicious PHP web shells. Successful exploitation grants the attacker complete control over the affected server, enabling data theft, modification, and further lateral movement within the network. The potential for data exfiltration and system takeover is significant, mirroring the impact of other SSTI vulnerabilities like those seen in earlier template engines.

1. Gereserveerd2026-05-05
2. Gepubliceerd2026-05-13

The primary mitigation for CVE-2026-44377 is to immediately upgrade CubeCart to version 6.7.0, which contains the necessary fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. While a direct WAF rule targeting the SSTI payload is difficult to create due to the dynamic nature of template injection, strict input validation on all user-supplied data within CubeCart templates can help reduce the attack surface. Review and restrict access to sensitive configuration files to limit potential data exposure. Monitor CubeCart logs for suspicious activity, particularly attempts to execute unusual PHP functions within templates. After upgrading to 6.7.0, verify the fix by attempting to inject a simple PHP payload within a template and confirming that it is properly sanitized and does not execute.