Read the docs
TI-2026-32334 Aliases CVE-2026-44377

CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE

Priority HIGH 74CWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1336.

Summary

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates and Documents). The application unsafely evaluates user-supplied input directly through the Smarty template engine. By leveraging this, an authenticated attacker with administrative privileges can bypass current restrictions and call native PHP functions within the templates, such as readgzfile() to read sensitive configuration files, or error_log() to write a malicious PHP web shell, ultimately achieving Information Disclosure and full Remote Code Execution (RCE). This vulnerability is fixed in 6.7.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00735 54th percentileScored 2026-11-07
Fix Fixed v6 (cubecart): 6.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cubecartv6before 6.7.06.7.0Patch availableCNA
  • v6 Vendorcubecart Affected before 6.7.0 Fixed in 6.7.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:cubecart:cubecart:*:*:*:*:*:*:*:*——cubecart
  • cpe:2.3:a:cubecart:cubecart:*:*:*:*:*:*:*:* Versions — — ·cubecart

Remediation

  • Fix · CNA v6 (cubecart) Fixed in 6.7.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44377

References

Other 2

  • TI-2024-23117 Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to… CVSS 3.1CRITICAL 9.8
  • TI-2026-33453 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE CVSS 3.1CRITICAL 9.1
  • TI-2026-32902 CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API CVSS 3.1CRITICAL 9.1
  • TI-2026-32904 CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header CVSS 3.1HIGH 8.1
  • TI-2024-22066 File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to… CVSS 3.1HIGH 8.0
  • TI-2025-36966 CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter CVSS 3.1MEDIUM 6.5
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences