Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-45053: CubeCart 6.6.9 and earlier: Authenticated File Upload Risk
CVE-2026-45053
Summary
CubeCart's file upload feature allows authorized users to upload malicious files that can be executed by the web server, potentially leading to unauthorized access and control of the website. To protect your website, update CubeCart to version 6.7.0 or later. If you cannot update immediately, limit access to the file upload feature and monitor your website closely for any suspicious activity.
Original title
CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Arbitrary File Upload vulnerability exists in the REST API File Manager endpoint (POST /api/v1/files) of CubeCart. The e...
Original description
CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Arbitrary File Upload vulnerability exists in the REST API File Manager endpoint (POST /api/v1/files) of CubeCart. The endpoint allows any holder of an API key with files:rw permission to upload PHP source files into the web-accessible images/source/ directory, where they are executed by the web server. Combined with a path-traversal flaw in the same endpoint's filepath parameter, a single API request writes a webshell anywhere the webserver process can write — including the document root — yielding full Remote Code Execution. This vulnerability is fixed in 6.7.0.
nvd CVSS3.1
9.1
Vulnerability type
CWE-434
Unrestricted File Upload
Published: 13 May 2026 · Updated: 28 May 2026 · First seen: 13 May 2026