# CVE-2026-45714: CubeCart SSTI in Smarty Templates leading to RCE

Source: https://junglewise.ai/threats/cve-2026-45714-cubecart-ssti-in-smarty-templates-leading-to-rce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-45714 · Severity: critical · CVSS 9.1 · Published 2026-05-13

CubeCart is an e-commerce platform used by businesses to manage online stores. A security vulnerability in its administrative modules allows an authorized administrator to execute malicious commands on the underlying web server. This could lead to a complete takeover of the online store, theft of customer data, or disruption of business operations.

Technologies: [CubeCart](https://junglewise.ai/threats/technologies/cubecart). Vendors: [CubeCart](https://junglewise.ai/threats/vendors/cubecart).

## Quick answers

**Is CVE-2026-45714 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45714 being exploited in the wild.

**How severe is CVE-2026-45714?** Critical severity, with a CVSS score of 9.1, published 13 May 2026.

**Which products and versions are affected?** CubeCart 6.x prior to 6.7.0.

**Is there a fix for CVE-2026-45714?** A patch was published on 2026-05-13: Vulnerability fixed in version 6.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45714 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45714?** Check whether you run CubeCart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Authenticated Server-Side Template Injection (SSTI) vulnerability exists in CubeCart versions prior to 6.7.0 due to the insecure implementation of the Smarty template engine. The application fails to sanitize raw user input from $_POST data before processing it through the template engine in modules such as Email Templates, Invoices, and Documents. Specifically, the application uses $smarty->fetch('string:...') on raw input or retrieves content via $GLOBALS['RAW']['POST'], bypassing security filters. An attacker with administrative privileges can inject malicious Smarty tags (e.g., {system(...)}) to achieve Remote Code Execution (RCE) on the host server. The vulnerability is addressed in version 6.7.0 by implementing proper security policies for the template engine.

## Affected products

- CubeCart CubeCart 6.x prior to 6.7.0

## Timeline

- 2026-05-12: advisory: Original GitHub security advisory published
- 2026-05-13: disclosed: CVE published to NVD
- 2026-05-13: patched: Vulnerability fixed in version 6.7.0

## References

- [https://github.com/cubecart/v6/security/advisories/GHSA-pcfr-xgc9-xfv6](https://github.com/cubecart/v6/security/advisories/GHSA-pcfr-xgc9-xfv6)

## Related threats

- [CubeCart broken access control in GDPR customer purge](https://junglewise.ai/threats/cve-2026-54648-cubecart-broken-access-control-in-gdpr-customer-purge)
- [CubeCart SQL injection in download_expire settings parameter](https://junglewise.ai/threats/cve-2026-54647-cubecart-sql-injection-in-download-expire-settings-parameter)
- [CubeCart SQL identifier injection in maintenance tools](https://junglewise.ai/threats/cve-2026-54646-cubecart-sql-identifier-injection-in-maintenance-tools)
- [CubeCart stored XSS in product description fields](https://junglewise.ai/threats/cve-2026-54645-cubecart-stored-xss-in-product-description-fields)
- [CubeCart XSS in GUI messages via unsafe anchor attributes](https://junglewise.ai/threats/cve-2026-54644-cubecart-xss-in-gui-messages-via-unsafe-anchor-attributes)