CVE-2026-45708 CubeCart: Authenticated RCE via Invoice Template → Order Print
An admin can inject PHP code into invoice templates, leading to remote code execution when orders are printed by any user.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45708?
CVE-2026-45708 is a high-severity code injection vulnerability in cubecart v6, published on 13 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw <?php … ?> into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print.<md5>.php. files/.htaccess ships an explicit <Files print.*.php> allow from all </Files> carve-out, so the file is fetched and executed by any unauthenticated visitor. This vulnerability is fixed in 6.7.3.
Weakness: CWE-94
Which versions are affected by CVE-2026-45708?
How do I fix CVE-2026-45708?
No fix has been published for CVE-2026-45708 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-45708 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45708 exists.
Sources
Also known as GHSA-747j-4mmc-cj63.