CVE-2026-45708
CubeCart is an ecommerce software solution.
Published May 13, 2026 · updated Jun 17, 2026
CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print. .php. files/.htaccess ships an explicit allow from all carve-out, so the file is fetched and executed by any unauthenticated visitor. This vulnerability is fixed in 6.7.3.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
May 13, 2026 · NIST NVD
Detected
CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print. .php. files/.htaccess ships an explicit allow from all carve-out, so the file is fetched and executed by any unauthenticated visitor. This vulnerability is fixed
Jun 17, 2026 · NIST NVD
Updated
CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print. .php. files/.htaccess ships an explicit allow from all carve-out, so the file is fetched and executed by any unauthenticated visitor. This vulnerability is fixed
Sources
- CVE.orgVulnerability recordCVE-2026-45708
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-45708
CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print. .php. files/.htaccess ships
nvd.nist.gov