What is the CVSS score of EUVD-2026-30176?

EUVD-2026-30176 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of CubeCart are affected by EUVD-2026-30176?

CubeCart v6 prior to version 6.7.0 contains a critical remote code execution vulnerability in its administrative interface that allows administrators to execute arbitrary code through template…. A patch is available.

How to fix or mitigate EUVD-2026-30176?

Within 24 hours: Identify all CubeCart v6 installations and determine versions; restrict administrative access to affected systems to essential personnel only and increase monitoring of admin activities. Within 7 days: Deploy CubeCart v6.7.0 patch to all affected instances and validate successful upgrade functionality. Within 30 days: Complete post-patch security audit, review admin activity logs for any suspicious template modifications prior to patching, and document remediation closure.

CubeCart EUVD-2026-30176

| CVE-2026-45714 CRITICAL

Code Injection (CWE-94)

2026-05-13 GitHub_M

RCE Code Injection Cubecart V6

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:24 vuln.today

Patch available

May 13, 2026 - 22:03 EUVD

CVE Published

May 13, 2026 - 20:43 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates, Invoices, Documents, and Contact Forms). The application unsafely evaluates user-supplied input using the Smarty template engine without enabling Smarty Security Policies. This allows any authenticated user with administrative privileges to execute arbitrary operating system commands (RCE) on the server. This vulnerability is fixed in 6.7.0.

AnalysisAI

Authenticated server-side template injection in CubeCart v6 prior to 6.7.0 allows administrative users to achieve remote code execution by injecting Smarty template syntax into multiple admin-facing modules including Email Templates, Invoices, Documents, and Contact Forms. The flaw stems from evaluating user-supplied content through the Smarty engine without enabling Smarty Security Policies, granting OS-level command execution on the underlying server. Currently no public exploit identified at time of analysis, EPSS is very low at 0.04%, and the issue is not on CISA KEV.

Technical ContextAI

CubeCart is a PHP-based open-source ecommerce platform that uses the Smarty templating engine to render storefront and backoffice content such as transactional emails, PDF invoices, downloadable documents, and customer-facing forms. Smarty supports a Security Policy mode that restricts which PHP functions, modifiers, and tags templates may invoke; when this policy is not enabled, template syntax like {php}, {if}, or modifiers can be abused to reach native PHP and execute system commands. The CWE-94 (Improper Control of Generation of Code / Code Injection) root cause here is that admin-supplied template bodies are passed directly into Smarty's parse-and-execute pipeline without sandboxing, turning template editors into code editors. The affected component is identified by CPE cpe:2.3:a:cubecart:v6:*:*:*:*:*:*:*:* covering the v6 branch.

RemediationAI

Apply the vendor-released patch by upgrading CubeCart v6 to version 6.7.0 or later, which is the fix identified in advisory GHSA-pcfr-xgc9-xfv6 (https://github.com/cubecart/v6/security/advisories/GHSA-pcfr-xgc9-xfv6). For deployments that cannot upgrade immediately, restrict administrative panel access by IP allowlist or VPN to limit who can reach the vulnerable template editors, enforce strong unique credentials and multi-factor authentication on all admin accounts, and audit the admin user list to remove unused or over-privileged accounts - these reduce the credentialed attack surface but do not remove the underlying SSTI. As a code-level workaround, an operator with PHP skills can enable Smarty's Security Policy on the affected template handlers to block {php} tags and unsafe modifiers, though this may break custom templates that rely on those features and should be tested against existing email and invoice content before rollout.