Which versions of Cubecart are affected by EUVD-2026-23366?

CubeCart versions prior to 6.6.0 contain an authenticated OS command injection vulnerability (CVSS 8.6) that allows administrators with high-privilege access to execute arbitrary system commands and…

How to fix or mitigate EUVD-2026-23366?

Within 24 hours: Inventory all CubeCart deployments and identify versions below 6.6.0; verify current admin user list and review recent admin account activity logs. Within 7 days: Upgrade all CubeCart instances to version 6.6.0 or later; reset all administrator credentials post-upgrade and enforce multi-factor authentication on admin accounts. Within 30 days: Conduct access reviews of administrative privileges; implement network segmentation to restrict admin interface exposure; enable enhanced logging and monitoring of CubeCart admin activity.

Cubecart EUVD-2026-23366

Q: What is the CVSS score of EUVD-2026-23366?

EUVD-2026-23366 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-21719 HIGH

OS Command Injection (CWE-78)

2026-04-17 jpcert

Command Injection Cubecart Cubecart Limited

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 20, 2026 - 14:59 vuln.today

v4 (cvss_changed)

Analysis Updated

Apr 17, 2026 - 06:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 17, 2026 - 06:22 vuln.today

cvss_changed

CVSS changed

Apr 17, 2026 - 06:22 NVD

7.2 (HIGH) 8.6 (HIGH)

Analysis Generated

Apr 17, 2026 - 05:36 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 05:30 euvd

EUVD-2026-23366

Analysis Generated

Apr 17, 2026 - 05:30 vuln.today

CVE Published

Apr 17, 2026 - 04:33 nvd

HIGH 8.6

DescriptionCVE.org

An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute an arbitrary OS command.

AnalysisAI

Authenticated OS command injection in CubeCart prior to version 6.6.0 allows administrators to execute arbitrary system commands on the hosting server. Reported by JPCERT, this vulnerability requires high-privilege (admin) access but then permits full system compromise. CVSS 8.6 severity reflects low attack complexity from network position once admin credentials obtained. EPSS exploitation probability is low (0.18%, 40th percentile) with no active exploitation confirmed in CISA KEV or SSVC data, though POC status unknown. CubeCart 6.6.0 addresses this CWE-78 command injection flaw per vendor community announcement.

Technical ContextAI

This is a classic OS command injection vulnerability (CWE-78) in CubeCart, a PHP-based e-commerce shopping cart platform. Command injection occurs when user-supplied input is passed unsanitized to system shell execution functions like exec(), system(), or passthru() in PHP. In CubeCart versions before 6.6.0, administrative interface functionality improperly validates input before constructing OS commands, allowing attackers with admin privileges to inject shell metacharacters (semicolons, pipes, backticks) that break command boundaries and execute arbitrary commands. The affected CPE (cpe:2.3:a:cubecart_limited:cubecart) indicates this affects CubeCart Limited's core product across all deployment platforms. Unlike unauthenticated command injection seen in internet-facing appliances, this requires authenticated administrative session context, significantly reducing attack surface but not eliminating risk from compromised admin accounts, insider threats, or multi-stage attacks.

RemediationAI

Upgrade to CubeCart version 6.6.0 or later immediately, as confirmed by vendor community announcement at https://community.cubecart.com/t/cubecart-6-6-0-released-the-biggest-update-in-years/62405. The 6.6.0 release explicitly addresses this command injection vulnerability along with other security improvements. For installations unable to upgrade immediately, implement compensating controls: restrict administrative panel access to specific IP addresses via web server configuration (Apache Allow/Deny directives or Nginx allow/deny rules), enforce multi-factor authentication on all administrative accounts to prevent credential compromise (consider using Google Authenticator or hardware tokens integrated with CubeCart's authentication system), enable comprehensive audit logging for all admin actions with real-time monitoring for suspicious command patterns, and segment the web server environment to limit lateral movement if exploitation occurs (run CubeCart in containerized or jailed environment with minimal system command access). Note that IP restrictions may disrupt legitimate remote administration, MFA adds user friction for admin workflows, and environment segmentation requires infrastructure reconfiguration. These mitigations reduce but do not eliminate risk; version upgrade remains the definitive solution. Verify patched version by checking admin panel footer or /admin.php version string matches 6.6.0 or higher post-upgrade.