Executive brief
CubeCart is an e-commerce platform used by businesses to manage online stores. A security vulnerability in its administrative modules allows an authorized administrator to execute malicious commands on the underlying web server. This could lead to a complete takeover of the online store, theft of customer data, or disruption of business operations.
Technical details
An Authenticated Server-Side Template Injection (SSTI) vulnerability exists in CubeCart versions prior to 6.7.0 due to the insecure implementation of the Smarty template engine. The application fails to sanitize raw user input from $_POST data before processing it through the template engine in modules such as Email Templates, Invoices, and Documents. Specifically, the application uses $smarty->fetch('string:...') on raw input or retrieves content via $GLOBALS['RAW']['POST'], bypassing security filters. An attacker with administrative privileges can inject malicious Smarty tags (e.g., {system(...)}) to achieve Remote Code Execution (RCE) on the host server. The vulnerability is addressed in version 6.7.0 by implementing proper security policies for the template engine.
Affected products
- CubeCart CubeCart 6.x prior to 6.7.0
Timeline
- 2026-05-12: advisory: Original GitHub security advisory published
- 2026-05-13: disclosed: CVE published to NVD
- 2026-05-13: patched: Vulnerability fixed in version 6.7.0