CVE-2026-45714: CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates, Invoices, Documents, and Contact Forms). The application unsafely evaluates user-supplied input using the Smarty template engine without enabling Smarty Security Policies. This allows any authenticated user with administrative privileges to execute arbitrary operating system commands (RCE) on the server. This vulnerability is fixed in 6.7.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45714?
CVE-2026-45714 is considered a high severity vulnerability due to its potential for Remote Code Execution (RCE).
How do I fix CVE-2026-45714?
To fix CVE-2026-45714, upgrade CubeCart to version 6.7.0 or later, where the vulnerability has been patched.
What systems are affected by CVE-2026-45714?
CVE-2026-45714 affects CubeCart versions prior to 6.7.0 that utilize the Smarty template engine.
What type of vulnerability is CVE-2026-45714?
CVE-2026-45714 is classified as a Server-Side Template Injection (SSTI) vulnerability.
Can CVE-2026-45714 be exploited remotely?
Yes, CVE-2026-45714 can be exploited remotely, allowing attackers to execute arbitrary code on the server.