{“lastseen”:””,”description”:”CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw \\u003c?php \u2026 ?\\u003e into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files\/print.\\u003cmd5\\u003e.php. files\/.htaccess ships an explicit \\u003cFiles print.*.php\\u003e allow from all \\u003c\/Files\\u003e carve-out, so the file is fetched and executed by any unauthenticated visitor. This vulnerability is fixed in 6.7.3.”,”published”:”2026-05-13T20:46:51.582Z”,”modified”:”2026-05-13T20:46:51.582Z”,”type”:”cve”,”title”:”CubeCart: Authenticated RCE via Invoice Template \u2192 Order Print”,”source”:”GitHub_M”,”references”:”https:\/\/github.com\/cubecart\/v6\/security\/advisories\/GHSA-747j-4mmc-cj63″,”id”:”CVE-2026-45708″,”bulletinFamily”:””,”cwe”:[“CWE-94″],”cvelist”:null,”sourceData”:”cubecart v6 \\u003c 6.7.3″,”sourceHref”:””,”cvss”:{“score”:7.2,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”v6″,”version”:”\\u003c 6.7.3″,”vendor”:”cubecart”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw \\u003c?php \u2026 ?\\u003e into the Invoice Editor….<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,39,12,15,13,7,11,5],"class_list":["post-54331","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-72","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n