CVE-2026-45714CWE-1336CWE-94

CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE

Critical · published May 13, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
44.6
In the wild
Unconfirmed
What it is

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates, Invoices, Documents, and Contact Forms). The application unsafely evaluates user-supplied input using the Smarty template engine without enabling Smarty Security Policies. This allows any authenticated user with administrative privileges to execute arbitrary operating system commands (RCE) on the server. This vulnerability is fixed in 6.7.0.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00540 · 44.6th percentile
Weaknesses
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine; CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-05-13T20:43Z
EPSS history
Timeline
  • 13 MAY 20:43Z
    CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
    cvelistv5