Vulnerability · Published May 13, 2026 · Assigned by GitHub_M

CVE-2026-45714CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE

Critical 9.1

In plain English

A critical-severity code injection in v6 from cubecart. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.4%top 64.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates, Invoices, Documents, and Contact Forms). The application unsafely evaluates user-supplied input using the Smarty template engine without enabling Smarty Security Policies. This allows any authenticated user with administrative privileges to execute arbitrary operating system commands (RCE) on the server. This vulnerability is fixed in 6.7.0.

Affected products (as reported)

Vendor	Product	Versions
cubecart	v6	< 6.7.0

Weakness: CWE-94, CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/cubecart/v6/security/advisories/GHSA-pcfr-xgc9-xfv6 x_refsource_CONFIRM