CVE-2026-54645: CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, descriptionshort, and speccopy rich-text fields from $GLOBALS['RAW']['POST'] and removes only script elements before the values are stored and rendered through Smarty templates. An administrator with product-editing rights can store event-handler attributes, SVG content, or javascript: URIs that bypass this filter, causing persistent JavaScript execution when a storefront visitor or another administrator views the product content and enabling session exposure or unauthorized browser-context actions. This issue is fixed in version 6.7.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CubeCartto a version that resolves this vulnerability.Fixed in 6.7.5
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated CubeCart administrator with product-editing rights is required to store the malicious product content. The payload executes when a storefront visitor or another administrator views the affected product content.
Are standard product-description fields affected?
Yes. The affected rich-text fields are description, description_short, and spec_copy in the product editor.
What is the remediation?
Upgrade CubeCart to version 6.7.5, which fixes the issue.
How can we determine whether product content may already be malicious?
Review existing values in the affected product rich-text fields for event-handler attributes, SVG content, and javascript: URIs. These payload types can bypass the prior filter, which removed only script elements.