What is the CVSS score of CVE-2026-45053?

CVE-2026-45053 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of CubeCart are affected by CVE-2026-45053?

CubeCart v6 installations prior to version 6.7.0 face critical remote code execution risk through a path-traversal vulnerability in the REST API file upload endpoint.. A patch is available.

How to fix or mitigate CVE-2026-45053?

Within 24 hours: Audit all CubeCart installations and identify versions prior to 6.7.0; disable or rotate API keys if not immediately patching. Within 7 days: Upgrade all affected CubeCart v6 instances to version 6.7.0 or later. Within 30 days: Verify successful upgrades across all instances, review API key access controls and permission assignments, and analyze web server logs for suspicious file uploads.

CubeCart CVE-2026-45053

EUVD-2026-30170 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-13 GitHub_M

PHP RCE File Upload Cubecart V6

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:22 vuln.today

Patch available

May 13, 2026 - 22:03 EUVD

CVE Published

May 13, 2026 - 20:42 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Arbitrary File Upload vulnerability exists in the REST API File Manager endpoint (POST /api/v1/files) of CubeCart. The endpoint allows any holder of an API key with files:rw permission to upload PHP source files into the web-accessible images/source/ directory, where they are executed by the web server. Combined with a path-traversal flaw in the same endpoint's filepath parameter, a single API request writes a webshell anywhere the webserver process can write - including the document root - yielding full Remote Code Execution. This vulnerability is fixed in 6.7.0.

AnalysisAI

Remote code execution in CubeCart v6 prior to 6.7.0 allows API key holders with files:rw permission to upload PHP webshells via the POST /api/v1/files REST endpoint. A path-traversal flaw in the filepath parameter lets attackers write executable files anywhere the webserver can write, including the document root, achieving full server takeover. No public exploit identified at time of analysis, though SSVC notes a POC and EPSS sits at 0.19% (40th percentile).

Technical ContextAI

CubeCart is a PHP-based open-source ecommerce platform deployed on customer-managed LAMP/LEMP stacks (CPE: cpe:2.3:a:cubecart:v6). The vulnerability resides in the REST API File Manager endpoint (POST /api/v1/files), which fails to validate file extensions before writing user-supplied content to disk - a textbook CWE-434 (Unrestricted Upload of File with Dangerous Type). Compounding this, the filepath parameter lacks normalization, so '../' sequences traverse out of images/source/ into the document root. Because uploaded .php files land in a web-accessible location and are interpreted by the PHP runtime, file write equates directly to code execution under the webserver user.

RemediationAI

Vendor-released patch: upgrade to CubeCart 6.7.0 or later, per advisory GHSA-652f-8c88-25cx (https://github.com/cubecart/v6/security/advisories/GHSA-652f-8c88-25cx). For operators who cannot immediately upgrade, revoke or rotate any API keys carrying the files:rw permission and audit existing keys for least-privilege scoping - this directly eliminates the precondition for exploitation but will break legitimate integrations that depend on programmatic file management. As an additional layer, deny PHP execution inside images/source/ via webserver configuration (e.g., an Apache 'php_admin_flag engine off' block or nginx location rule), and block POST requests to /api/v1/files at the WAF or reverse proxy for clients that should not be invoking the file manager; note these controls do not stop the path-traversal write to other writable directories, only execution from the upload target. After patching, audit images/source/ and the document root for unexpected .php files dropped before the fix.