Read the docs
TI-2017-01422 Aliases CVE-2017-2117GHSA-8chh-942c-pr7m

Path traversal in CubeCart

Priority LOW 27CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Directory traversal vulnerability in CubeCart versions prior to 6.1.5 allows attacker with administrator rights to read arbitrary files via unspecified vectors.

Why it matters now

EPSS 0.02127 82nd percentileScored 2026-11-07
Fix Fixed CubeCart (CubeCart Limited): 6.1.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
cubecartCubeCartbefore 6.1.56.1.5Patch availableCNA
  • CubeCart Vendorcubecart Affected before 6.1.5 Fixed in 6.1.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cubecart:cubecart:*:*:*:*:*:*:*:*up to 6.1.4Vulnerablecubecart
  • cpe:2.3:a:cubecart:cubecart:*:*:*:*:*:*:*:* Versions up to 6.1.4 Vulnerable ·cubecart

Remediation

  • Fix · CNA CubeCart (CubeCart Limited) Fixed in 6.1.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-2117
  2. 2026-10-03 Alias added: GHSA-8chh-942c-pr7m

References

Patch 1

Advisory 1

  • TI-2024-23117 Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to… CVSS 3.1CRITICAL 9.8
  • TI-2024-22066 File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to… CVSS 3.1HIGH 8.0
  • TI-2025-36966 CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter CVSS 3.1MEDIUM 6.5
  • TI-2025-36897 CubeCart Session Not Invalidated After Password Change CVSS 3.1HIGH 7.1
  • TI-2025-36965 CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement CVSS 3.1MEDIUM 5.4
  • TI-2025-36964 CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry CVSS 3.1MEDIUM 5.4
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences