What is the CVSS score of CVE-2026-45708?

CVE-2026-45708 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of CubeCart are affected by CVE-2026-45708?

CubeCart v6 prior to version 6.7.3 contains a remote code execution vulnerability exploitable by administrator-level users with documents-edit permissions.. A patch is available.

How to fix or mitigate CVE-2026-45708?

24 hours: Identify all CubeCart v6 installations and document current versions; review administrator activity logs for suspicious behavior or unauthorized template modifications. 7 days: Upgrade all affected instances to CubeCart 6.7.3 or later following vendor procedures with staging environment validation. 30 days: Confirm patches deployed across all systems, audit administrative account permissions for least-privilege alignment, and implement continuous monitoring of admin activity.

CubeCart CVE-2026-45708

EUVD-2026-30175 HIGH

Code Injection (CWE-94)

2026-05-13 GitHub_M

PHP RCE Code Injection Cubecart V6

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:04 vuln.today

Patch available

May 13, 2026 - 22:03 EUVD

DescriptionGitHub Advisory

CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw <?php … ?> into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print.<md5>.php. files/.htaccess ships an explicit <Files print.*.php> allow from all </Files> carve-out, so the file is fetched and executed by any unauthenticated visitor. This vulnerability is fixed in 6.7.3.

AnalysisAI

Authenticated remote code execution in CubeCart v6 prior to 6.7.3 allows an admin with documents-edit permission to embed raw PHP into the Invoice Editor template, which is later written to a predictable files/print.<md5>.php path that the bundled .htaccess explicitly exposes to unauthenticated visitors. SSVC rates technical impact as total and a POC exists, though EPSS remains very low (0.04%) and the issue is not on CISA KEV - no public exploit identified at time of analysis beyond researcher disclosure.

Technical ContextAI

CubeCart is a PHP-based open-source ecommerce platform whose Invoice Editor stores admin-supplied template HTML and renders it server-side when an order is printed. The rendered output is materialized to disk inside the public files/ directory using an MD5-hashed name, and the shipped files/.htaccess contains a deliberate <Files print.*.php> 'allow from all' carve-out - intended to permit print artifacts but in practice allowing any *.php file matching that pattern to be served and executed by the PHP handler. Combined with the lack of output sanitization on '<?php ... ?>' fragments, this is a textbook CWE-94 code-injection sink: attacker-controlled template content reaches eval-equivalent semantics through the PHP interpreter. Affected CPE is cpe:2.3:a:cubecart:v6:*.

RemediationAI

Vendor-released patch: upgrade to CubeCart 6.7.3 or later, per GHSA-747j-4mmc-cj63 (https://github.com/cubecart/v6/security/advisories/GHSA-747j-4mmc-cj63). If immediate upgrade is not possible, remove or tighten the '<Files print.*.php> allow from all' block in files/.htaccess so that .php files in files/ are not served - note this will break legitimate print-preview retrieval until patched; alternatively configure the webserver to refuse PHP execution under files/ entirely (AddHandler/SetHandler override or php_flag engine off), and audit existing files/print.*.php artifacts for backdoors. As an interim access-control measure, revoke 'documents edit' permission from all but trusted administrators and rotate admin credentials, accepting the loss of template self-service for those users.