CVE-2026-45055
HighSummary
CubeCart prior to version 6.7.2 has a vulnerability that allows an attacker to take over a user account by manipulating links in emails. An attacker can exploit the Host header to send a malicious link to the victim, leading to account takeover.
Risk Assessment
Organizations using CubeCart versions 6.6.x – 6.7.1 are at risk of attacks that can lead to full account takeover of user and admin accounts. This poses a serious threat to customer data security.
Recommendation
It is recommended to update CubeCart to version 6.7.2 or later to eliminate this vulnerability. Additionally, implementing extra security measures such as monitoring unauthorized access attempts is advisable.
Other vulnerabilities in CubeCart
See all- CVE-2026-45708High
CubeCart is an ecommerce software solution that prior to version 6.7.3 allowed admins with document edit permissions to save raw PHP code in the Invoice Editor. When any admin clicks Print, the rendered template is saved in a file that can be executed by unauthenticated users.
- CVE-2026-39358High
In CubeCart prior to version 6.6.0, authenticated time-based blind SQL injection vulnerabilities were identified in the sorting parameters (sort[price], sort_activity, sort_admin, and sort_customer) of the Products and Logs endpoints. This allows an attacker to execute arbitrary SQL commands, compromising the confidentiality and integrity of the database.
- CVE-2026-45714Critical
CubeCart prior to version 6.7.0 has an Authenticated Server-Side Template Injection (SSTI) vulnerability in multiple modules, including Email Templates, Invoices, Documents, and Contact Forms. The application unsafely evaluates user-supplied input, allowing authenticated users with administrative privileges to execute arbitrary operating system commands.
- CVE-2026-45053Critical
CubeCart prior to version 6.7.0 contained an Authenticated Arbitrary File Upload vulnerability in the REST API File Manager endpoint. This allows any holder of an API key with files:rw permission to upload PHP files to the images/source/ directory, where they are executed by the web server.
- CVE-2026-44377Critical
CubeCart prior to version 6.7.0 has an Authenticated Server-Side Template Injection (SSTI) vulnerability in multiple modules, including Email Templates and Documents. The application unsafely evaluates user-supplied input through the Smarty template engine.
Original NVD description (English source)
CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CC_STORE_URL directly from the Host request header at bootstrap, with no allowlist. The constant is embedded verbatim into transactional email links, most critically the password-reset link in User::passwordRequest() (and the admin equivalent in Admin::passwordRequest()). An unauthenticated attacker who knows a target email can POST /index.php?_a=recover with Host: evil.com; CubeCart writes a fresh verify token (valid 3,600 s) and emails the victim a link http://evil.com/index.php?_a=recovery&validate=<TOKEN>. The token is valid against the legitimate store — capturing the victim's click on evil.com yields full account takeover, or store takeover when an admin email is targeted. This vulnerability is fixed in 6.7.2.