CVE-2026-45708: CubeCart: Authenticated RCE via Invoice Template → Order Print
CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw <?php … ?> into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print.<md5>.php. files/.htaccess ships an explicit <Files print..php> allow from all </Files> carve-out, so the file is fetched and executed by any unauthenticated visitor. This vulnerability is fixed in 6.7.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45708?
CVE-2026-45708 is classified as a critical vulnerability due to the potential for remote code execution.
How do I fix CVE-2026-45708?
To mitigate CVE-2026-45708, upgrade CubeCart to version 6.7.3 or later.
Who is affected by CVE-2026-45708?
CVE-2026-45708 affects CubeCart installations prior to version 6.7.3 where admins can edit invoice templates.
What is the exploit mechanism for CVE-2026-45708?
CVE-2026-45708 allows authenticated admins to inject PHP code into the invoice template, which is executed when printing an order.
What type of attack can CVE-2026-45708 facilitate?
CVE-2026-45708 facilitates remote code execution attacks if an attacker gains access to an admin account.