CubeCart CVE-2026-45714: Authenticated RCE Via Template Injection

The National Vulnerability Database has detailed CVE-2026-45714, a critical Server-Side Template Injection (SSTI) vulnerability in CubeCart, an e-commerce software solution. This flaw, present in versions prior to 6.7.0, allows authenticated administrative users to achieve arbitrary operating system command execution (RCE) on the server. The vulnerability stems from CubeCart’s unsafe evaluation of user-supplied input across multiple modules—including Email Templates, Invoices, Documents, and Contact Forms—without enforcing Smarty Security Policies.

This is a significant issue for any organization running vulnerable CubeCart instances. An attacker who gains administrative credentials, whether through phishing, brute-force, or another exploit, can leverage this SSTI to compromise the entire server. Given the CVSS score of 9.1 (Critical), the impact is severe: full confidentiality, integrity, and availability compromise of the underlying system.

Defenders must prioritize patching CubeCart installations to version 6.7.0 or newer. Beyond patching, organizations should implement strict access controls for administrative interfaces, enforce multi-factor authentication (MFA) for all admin accounts, and regularly audit logs for unusual activity or unauthorized access attempts to administrative panels. The attacker’s calculus here is clear: once they have admin access, this vulnerability provides a direct path to full system control, making it a high-value target.