Cubecart CVE-2026-35496

Q: What is the CVSS score of CVE-2026-35496?

CVE-2026-35496 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23370 MEDIUM

Path Traversal (CWE-22)

2026-04-17 jpcert

GHSA-4p7p-gf39-gmhp

Path Traversal Cubecart Cubecart Limited

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 17, 2026 - 06:22 NVD

LOW MEDIUM

CVSS changed

Apr 17, 2026 - 06:22 NVD

2.7 (LOW) 5.1 (MEDIUM)

Analysis Generated

Apr 17, 2026 - 05:36 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 05:30 euvd

EUVD-2026-23370

Analysis Generated

Apr 17, 2026 - 05:30 vuln.today

CVE Published

Apr 17, 2026 - 04:33 nvd

MEDIUM 5.1

DescriptionCVE.org

A path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to access higher-level directories that should not be accessible.

AnalysisAI

CubeCart administrative users can exploit a path traversal vulnerability prior to version 6.6.0 to read files from higher-level directories on the server, bypassing intended directory access restrictions. The vulnerability requires administrative privileges and affects CubeCart installations below 6.6.0. No active exploitation or public proof-of-concept has been identified; the low CVSS score (2.7) reflects the requirement for elevated privileges, making this a post-compromise lateral movement vector rather than an initial access risk.

Technical ContextAI

Path traversal vulnerabilities (CWE-22) occur when an application fails to properly validate or sanitize user-supplied input used in file path operations, allowing attackers to use directory navigation sequences (e.g., '../../../') to access files outside the intended directory structure. In CubeCart, the affected code path likely processes administrative requests involving file operations without adequate path canonicalization or validation. The vulnerability is network-accessible but requires valid administrator credentials, limiting its attack surface to authenticated administrative sessions. The CubeCart e-commerce platform is built on PHP and manages product catalogs, customer data, and configuration files - all potential targets for an abusive admin seeking to escalate access within the server filesystem.

RemediationAI

Upgrade CubeCart to version 6.6.0 or later immediately. This patched version was officially released and addresses the path traversal vulnerability. If immediate upgrade is not feasible, restrict administrative account access to only those users requiring it, implement filesystem-level access controls to limit CubeCart process permissions to its intended directory tree, and monitor administrative user activity for suspicious file access patterns or requests to access parent directories. Additionally, configure the web server (Apache, Nginx) with directory restrictions to prevent serving files outside the CubeCart root; for example, use PHP's open_basedir directive set to the CubeCart installation root to prevent script execution from unintended paths. These compensating controls reduce but do not eliminate the risk and should be temporary measures pending upgrade. See https://community.cubecart.com/t/cubecart-6-6-0-released-the-biggest-update-in-years/62405 for upgrade details.