CVE-2026-45714: CubeCart Server-Side Template Injection RCE

CVE-2026-45714 Overview

CVE-2026-45714 is an authenticated Server-Side Template Injection (SSTI) vulnerability in CubeCart, an open-source ecommerce platform. The flaw exists in multiple administrative modules including Email Templates, Invoices, Documents, and Contact Forms. CubeCart passes user-supplied input to the Smarty template engine without enabling Smarty Security Policies. Authenticated administrators can inject template directives that the engine evaluates server-side, leading to arbitrary operating system command execution. The issue is tracked under [CWE-94] Improper Control of Generation of Code and is fixed in CubeCart 6.7.0.

Critical Impact

Authenticated administrators can achieve remote code execution on the underlying server, compromising the web host, customer data, and payment integrations.

Affected Products

• CubeCart versions prior to 6.7.0
• Smarty template engine integration within CubeCart admin modules
• Self-hosted CubeCart deployments exposing the admin panel

Discovery Timeline

• 2026-05-13 - CVE-2026-45714 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-45714

Vulnerability Analysis

The vulnerability is a Server-Side Template Injection in CubeCart's administrative interface. Several modules accept input that is later rendered by Smarty without sandbox restrictions. Smarty supports inline PHP-equivalent constructs and access to PHP functions when its security policy is disabled. An authenticated administrator can submit template syntax in fields such as email templates, invoice content, document bodies, and contact form templates. CubeCart stores and renders that content through Smarty, triggering evaluation of attacker-controlled directives. Because Smarty executes within the PHP process, attackers gain code execution at the privilege level of the web server user, typically www-data or apache.

Root Cause

The root cause is the absence of an enabled Smarty Security Policy. Smarty exposes a Smarty_Security class that restricts which PHP functions, modifiers, and tags templates may invoke. CubeCart did not instantiate or apply this policy before rendering admin-supplied content. As a result, dangerous Smarty constructs such as {php} blocks or function tags that wrap system, exec, and passthru remain reachable. The defect maps to [CWE-94] Improper Control of Generation of Code.

Attack Vector

Exploitation requires valid administrator credentials, so the prerequisite is account compromise, insider access, or weak admin authentication. The attacker logs into the CubeCart admin panel and edits an affected template module. The injected Smarty payload is saved and rendered when the template is previewed, sent, or otherwise processed. The Smarty engine evaluates the payload server-side and executes the embedded operating system command. From there, attackers can pivot to web shell deployment, customer database exfiltration, or lateral movement within the hosting environment. No code example is reproduced here; refer to the GitHub Security Advisory GHSA-pcfr-xgc9-xfv6 for vendor-published details.

Detection Methods for CVE-2026-45714

Indicators of Compromise

• Unexpected modifications to records in the CubeCart_email_content, CubeCart_documents, or related template tables.
• Web server processes (php-fpm, apache2) spawning shell utilities such as sh, bash, nc, curl, or wget.
• Outbound network connections from the CubeCart host to unfamiliar IPs shortly after admin template edits.
• New files written under the CubeCart web root, particularly PHP files in images/, cache/, or admin/ directories.

Detection Strategies

• Inspect application logs and database audit trails for template edits containing Smarty tokens such as {php}, {function, or {eval.
• Hunt for process trees where the PHP interpreter is the parent of operating system command binaries.
• Correlate admin authentication events with subsequent template modifications and outbound traffic spikes.

Monitoring Recommendations

• Enable verbose logging on the CubeCart admin panel and forward events to a centralized SIEM.
• Alert on any creation or modification of .php files within the CubeCart installation directory outside of patch windows.
• Track administrator session activity, especially edits to Email Templates, Invoices, Documents, and Contact Forms modules.

How to Mitigate CVE-2026-45714

Immediate Actions Required

• Upgrade all CubeCart instances to version 6.7.0 or later without delay.
• Audit all administrator accounts, rotate passwords, and enforce multi-factor authentication on the admin panel.
• Review existing template content in affected modules for Smarty constructs introduced by attackers.

Patch Information

CubeCart resolved the issue in version 6.7.0 by enforcing Smarty Security Policies on user-controllable template rendering. Administrators should download the release directly from the vendor and validate file integrity before deployment. Refer to the GitHub Security Advisory GHSA-pcfr-xgc9-xfv6 for the official fix notes.

Workarounds

• Restrict admin panel access by source IP using web server or firewall rules until the upgrade is applied.
• Remove unused administrator accounts and limit administrative privileges to the smallest necessary set of users.
• Deploy a web application firewall rule to flag Smarty syntax tokens in POST bodies targeting /admin.php endpoints.

# Example Apache restriction limiting admin access to a trusted CIDR
<Location "/admin.php">
    Require ip 203.0.113.0/24
</Location>