CVE-2026-45708 in CubeCart
Summary
by MITRE • 05/14/2026
CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print..php. files/.htaccess ships an explicit allow from all carve-out, so the file is fetched and executed by any unauthenticated visitor. This vulnerability is fixed in 6.7.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/14/2026
This vulnerability represents a critical server-side code execution flaw in CubeCart ecommerce software affecting versions prior to 6.7.3. The issue stems from insufficient input validation and sanitization within the admin interface's Invoice Editor functionality, where administrators with document editing permissions can inject and save raw code into template files. The vulnerability is categorized under CWE-94 - Improper Control of Generation of Code and aligns with ATT&CK technique T1190 - Exploit Public-Facing Application, as it allows unauthenticated attackers to execute arbitrary code on the server through a web application interface. The flaw specifically manifests when administrators save content containing executable code within the invoice template editor, which is then rendered and written to the files/print..php file location on the server filesystem.
The operational impact of this vulnerability is severe and potentially catastrophic for affected systems. When any administrator clicks the Print function on an order, the maliciously crafted template content is written to a php file that becomes executable by the web server. The inclusion of a .htaccess file with explicit allow from all directives creates an attack surface where any unauthenticated visitor can directly access and execute the saved php file. This configuration effectively transforms what should be a controlled administrative function into a public code execution endpoint. The vulnerability allows attackers to execute arbitrary commands on the server, potentially leading to complete system compromise, data exfiltration, and unauthorized access to customer information. The attack requires minimal privileges and can be exploited by anyone with access to the administrative interface, making it particularly dangerous in environments where administrative credentials might be compromised.
The fix implemented in version 6.7.3 addresses this vulnerability through comprehensive input sanitization and validation mechanisms that prevent raw code injection into template files. The patch ensures that any content saved within the Invoice Editor is properly escaped and validated before being written to filesystem locations, eliminating the possibility of executable code being stored in the print template files. Organizations should immediately upgrade to version 6.7.3 or later to remediate this vulnerability. Additional mitigations include implementing strict access controls for administrative interfaces, monitoring for unauthorized file modifications in the print template directories, and ensuring that .htaccess files do not contain overly permissive allow directives. Security teams should also conduct comprehensive audits of administrative interfaces to identify similar code execution vulnerabilities and implement proper input validation across all user-editable template systems. This vulnerability highlights the critical importance of validating and sanitizing all user-provided content in web applications, particularly within administrative functions that can write to filesystem locations, and demonstrates how seemingly minor configuration issues can create severe security risks.