Executive brief
CubeCart is an e-commerce platform used to manage online stores. A security vulnerability in its template management system allows an administrative user to execute unauthorized commands on the underlying server. This could lead to a total system takeover, the theft of sensitive customer data, or the exposure of database credentials, potentially resulting in a complete business disruption.
Technical details
An Authenticated Server-Side Template Injection (SSTI) vulnerability exists in CubeCart versions prior to 6.7.0 due to an incomplete Smarty Security Policy. While common execution functions like system() were restricted, the application failed to block other dangerous native PHP functions. An attacker with administrative privileges can inject malicious Smarty tags into modules such as Email Templates or Documents. By invoking functions like error_log() to write files or readgzfile() to read them, an attacker can achieve arbitrary file read/write, leading to full Remote Code Execution (RCE) and information disclosure. The issue is addressed in version 6.7.0 by extending the Smarty Security denylist.
Affected products
- CubeCart CubeCart < 6.7.0
Timeline
- 2026-04-29: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: CVE published to NVD