What is CVE-2026-45714?

CVE-2026-45714 is a critical-severity vulnerability in Cubecart V6, classified under Code Injection. CVSS score: 9.1/10. Published 2026-05-13.

How severe is CVE-2026-45714?

Critical severity. CVSS v3 base score is 9.1 out of 10.

RCE in Cubecart V6

CVE-2026-45714

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates, Invoices, Documents, and Contact Forms). The application unsafely evaluates user-supplied input using the Smarty template engine without enabling Smarty Security Policies. This allows any authenticated user with administrative privileges to execute arbitrary operating system commands (RCE) on the server. This vulnerability is fixed in 6.7.0.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.004 (34.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Cubecart V6 — versions < 6.7.0

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-45714?: CVE-2026-45714 is a critical-severity vulnerability in Cubecart V6, classified under Code Injection. CVSS score: 9.1/10. Published 2026-05-13.
How severe is CVE-2026-45714?: Critical severity. CVSS v3 base score is 9.1 out of 10.