Vulnerability Description
CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates and Documents). The application unsafely evaluates user-supplied input directly through the Smarty template engine. By leveraging this, an authenticated attacker with administrative privileges can bypass current restrictions and call native PHP functions within the templates, such as readgzfile() to read sensitive configuration files, or error_log() to write a malicious PHP web shell, ultimately achieving Information Disclosure and full Remote Code Execution (RCE). This vulnerability is fixed in 6.7.0.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/cubecart/v6/commit/76d783c8c4d87a8a90dbfef1344a2733e7c6434c
- https://github.com/cubecart/v6/security/advisories/GHSA-wpjx-g695-qc5j
- https://github.com/cubecart/v6/security/advisories/GHSA-wpjx-g695-qc5j
FAQ
What is CVE-2026-44377?
CVE-2026-44377 is a vulnerability with a CVSS score of 9.1 (CRITICAL). CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates and D...
How severe is CVE-2026-44377?
CVE-2026-44377 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-44377?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.