What is the CVSS score of CVE-2026-44377?

CVE-2026-44377 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of CubeCart are affected by CVE-2026-44377?

CubeCart v6 before version 6.7.0 contains a critical server-side template injection vulnerability accessible to administrators, enabling remote code execution through template and document functions.. A patch is available.

How to fix or mitigate CVE-2026-44377?

Within 24 hours: Audit administrator access logs and restrict template editing permissions to essential personnel. Within 7 days: Upgrade all CubeCart v6 instances to version 6.7.0. Within 30 days: Conduct security review of administrative role permissions and implement controls limiting access to template and document functions.

CubeCart CVE-2026-44377

EUVD-2026-30165 CRITICAL

Code Injection (CWE-94)

2026-05-13 GitHub_M

PHP RCE Information Disclosure Code Injection Cubecart V6

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 08:25 vuln.today

Analysis Generated

Jun 08, 2026 - 08:25 vuln.today

Patch available

May 13, 2026 - 22:03 EUVD

CVE Published

May 13, 2026 - 20:36 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates and Documents). The application unsafely evaluates user-supplied input directly through the Smarty template engine. By leveraging this, an authenticated attacker with administrative privileges can bypass current restrictions and call native PHP functions within the templates, such as readgzfile() to read sensitive configuration files, or error_log() to write a malicious PHP web shell, ultimately achieving Information Disclosure and full Remote Code Execution (RCE). This vulnerability is fixed in 6.7.0.

AnalysisAI

Authenticated server-side template injection in CubeCart v6 before 6.7.0 lets administrators escape the Smarty template sandbox and invoke native PHP functions through modules such as Email Templates and Documents. Attackers can call readgzfile() to exfiltrate configuration secrets and error_log() with message_type=3 to drop a PHP webshell, yielding full remote code execution. No public exploit identified at time of analysis, but a SSVC 'poc' status and an upstream commit hardening the Smarty allowlist indicate the technique is documented.

Technical ContextAI

CubeCart is a PHP ecommerce platform that renders administrative UI through the Smarty template engine wrapped by a CubeCart_Smarty_Security class. The root cause is CWE-94 (Code Injection): the security policy's disabled-function list did not block PHP primitives that can read or write arbitrary paths through Smarty's {php}-style or modifier syntax. The fix commit (76d783c) extends the blocklist to include error_log, readgzfile, gzfile, gzopen, simplexml_load_file (which honors php:// and file:// stream wrappers), glob/scandir/opendir, fileowner/filegroup/fileperms, dns_get_record, and pcntl_/posix_ process-control calls - confirming the abuse surface was native PHP exposed through Smarty rather than a parser bug.

RemediationAI

Vendor-released patch: upgrade to CubeCart 6.7.0, which extends the CubeCart_Smarty_Security disabled-function list to cover error_log, readgzfile, gzopen, simplexml_load_file, glob/scandir, and process-control functions as shown in commit 76d783c8c4d87a8a90dbfef1344a2733e7c6434c. Until the upgrade is applied, restrict the /admin path to known administrator IPs via web server ACLs (trade-off: blocks legitimate remote admin sessions), enforce MFA on all administrator accounts since exploitation requires PR:H, and audit Email Templates, Documents, and other Smarty-driven content for unexpected {php}, error_log, or readgzfile usage. Refer to https://github.com/cubecart/v6/security/advisories/GHSA-wpjx-g695-qc5j for the full advisory.