CVE-2026-45053: RCE in CubeCart v6 Ecommerce Software

The impact of this vulnerability is severe. An attacker with valid API credentials and the files:rw permission can leverage the REST API File Manager endpoint to upload malicious PHP files. The combination of arbitrary file upload and a path traversal vulnerability allows the attacker to write a webshell anywhere the webserver process can write, including the document root. This grants the attacker full remote code execution capabilities, enabling them to modify files, steal sensitive data (customer information, payment details, database credentials), install malware, and potentially pivot to other systems on the network. Successful exploitation could result in a complete compromise of the ecommerce platform and associated data, mirroring the impact of similar webshell vulnerabilities in other platforms.

1. Reservado2026-05-08
2. Publicada2026-05-13

The primary mitigation is to immediately upgrade CubeCart to version 6.7.0, which addresses this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict API key permissions to the minimum necessary. Implement strict input validation and sanitization on the filepath parameter in the REST API File Manager endpoint. Deploy a Web Application Firewall (WAF) with rules to detect and block suspicious file uploads, particularly those containing PHP code. Monitor web server logs for unusual file creation or modification activity in the images/source/ directory. After upgrading, verify the fix by attempting to upload a test PHP file with a benign payload through the API endpoint; it should be rejected.