Critical severity · published May 13, 2026
CVE-2026-45714
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
9.1
CVSS
0.4%
EPSS
No
On KEV
Description
CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates, Invoices, Documents, and Contact Forms). The application unsafely evaluates user-supplied input using the Smarty template engine without enabling Smarty Security Policies. This allows any authenticated user with administrative privileges to execute arbitrary operating system commands (RCE) on the server. This vulnerability is fixed in 6.7.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
V6
v6 · cubecart
< 6.7.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45714
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45714
github.com
https://github.com/cubecart/v6/security/advisories/GHSA-pcfr-xgc9-xfv6
More from v6
9.1
CVE-2026-45053
CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API
9.1
CVE-2026-44377
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
8.1
CVE-2026-45055
CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header
7.2
CVE-2026-54647
CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php
7.2
CVE-2026-54646
CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php