{"id":"CVE-2026-45708","aliases":["EUVD-2026-30175","GHSA-747j-4mmc-cj63"],"status":"published","title":"CubeCart: Authenticated RCE via Invoice Template → Order Print","description":"CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw \u003c?php … ?\u003e into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print.\u003cmd5\u003e.php. files/.htaccess ships an explicit \u003cFiles print.*.php\u003e allow from all \u003c/Files\u003e carve-out, so the file is fetched and executed by any unauthenticated visitor. This vulnerability is fixed in 6.7.3.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.00306,"percentile":0.23588,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2026-05-13T20:46:51Z","modified":"2026-10-28T02:30:44Z","products":[{"vendor":"cubecart","product":"v6"}],"references":[{"url":"https://github.com/cubecart/v6/security/advisories/GHSA-747j-4mmc-cj63","tags":["x_refsource_CONFIRM","exploit","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45708.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45708","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-45708","title":"CubeCart: Authenticated RCE via Invoice Template → Order Print","description":"CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw \u003c?php … ?\u003e into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print.\u003cmd5\u003e.php. files/.htaccess ships an explicit \u003cFiles print.*.php\u003e allow from all \u003c/Files\u003e carve-out, so the file is fetched and executed by any unauthenticated visitor. This vulnerability is fixed in 6.7.3.","status":"published","published":"2026-05-13T20:46:51.582Z","modified":"2026-05-14T19:52:20.652Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T13:46:32.755125Z"}],"euvd":[{"id":"EUVD-2026-30175","description":"CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw \u003c?php … ?\u003e into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print.\u003cmd5\u003e.php. files/.htaccess ships an explicit \u003cFiles print.*.php\u003e allow from all \u003c/Files\u003e carve-out, so the file is fetched and executed by any unauthenticated visitor. This vulnerability is fixed in 6.7.3.","status":"published","published":"2026-05-13T20:46:51Z","modified":"2026-05-14T19:52:20Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:04:30.595644Z"}],"nvd":[{"id":"CVE-2026-45708","description":"CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw \u003c?php … ?\u003e into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print.\u003cmd5\u003e.php. files/.htaccess ships an explicit \u003cFiles print.*.php\u003e allow from all \u003c/Files\u003e carve-out, so the file is fetched and executed by any unauthenticated visitor. This vulnerability is fixed in 6.7.3.","status":"published","published":"2026-05-13T21:16:49.877Z","modified":"2026-06-17T10:52:29.387Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"CVE-2026-45708","title":"CubeCart: Authenticated RCE via Invoice Template → Order Print","description":"CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw \u003c?php … ?\u003e into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print.\u003cmd5\u003e.php. files/.htaccess ships an explicit \u003cFiles print.*.php\u003e allow from all \u003c/Files\u003e carve-out, so the file is fetched and executed by any unauthenticated visitor. This vulnerability is fixed in 6.7.3.","status":"published","published":"2026-05-13T20:46:51.582Z","modified":"2026-10-28T02:30:44.512529593Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:45:05.525666Z"}]}}