Vulnerability · Published May 13, 2026 · Assigned by GitHub_M

CVE-2026-44377CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE

Critical 9.1

In plain English

A critical-severity code injection in v6 from cubecart. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.7%top 45.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates and Documents). The application unsafely evaluates user-supplied input directly through the Smarty template engine. By leveraging this, an authenticated attacker with administrative privileges can bypass current restrictions and call native PHP functions within the templates, such as readgzfile() to read sensitive configuration files, or error_log() to write a malicious PHP web shell, ultimately achieving Information Disclosure and full Remote Code Execution (RCE). This vulnerability is fixed in 6.7.0.

Affected products (as reported)

Vendor	Product	Versions
cubecart	v6	< 6.7.0

Weakness: CWE-94, CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/cubecart/v6/security/advisories/GHSA-wpjx-g695-qc5j x_refsource_CONFIRM
https://github.com/cubecart/v6/commit/76d783c8c4d87a8a90dbfef1344a2733e7c6434c x_refsource_MISC