Server-Side Template Injection Vulnerability in CubeCart E-commerce Software

CVE-2026-44377

What is CVE-2026-44377?

CubeCart, an e-commerce software solution, is affected by a vulnerability that allows an authenticated attacker with administrative privileges to exploit server-side template processing. Prior to version 6.7.0, multiple modules within CubeCart, including Email Templates and Documents, improperly evaluate user-supplied input through the Smarty template engine. This flaw enables attackers to bypass security controls and invoke native PHP functions, such as reading sensitive configuration files or executing malicious code. These actions can result in information disclosure and remote code execution, posing significant risks to the application's integrity and the security of its users.

References