Home / Vulnerability Intelligence / CVE-2026-45714

CVE-2026-45714 - Vulnerability Analysis

CriticalCVSS: 9.1

Last Updated: May 14, 2026

CubeCart - Server-Side Template Injection

Published: May 13, 2026Updated: May 14, 2026Remote Exploitable

Overview

CubeCart < 6.7.0 contains an authenticated server-side template injection caused by unsafe evaluation of user input in Smarty templates without security policies, letting authenticated admin users execute arbitrary OS commands.

Severity & Score

Severity: Critical

CVSS Score: 9.1

EPSS Score: 4.4%(Probability of exploitation in next 30 days)

Impact

Authenticated admin users can execute arbitrary operating system commands, potentially leading to full server compromise.

Mitigation

Upgrade to version 6.7.0 or later.

References

https://github.com/cubecart/v6/security/advisories/GHSA-pcfr-xgc9-xfv6

Social Media Activity(2 posts)

OffSequence

@offseq

May 14, 2026

🚨 CRITICAL: CVE-2026-45714 in CubeCart < 6.7.0 enables authenticated admins to execute OS commands via SSTI (Smarty engine) — full RCE risk. Patch to 6.7.0+ ASAP! https://radar.offseq.com/threat/cve-2026-45714-cwe-94-improper-control-of-generati-b4219bcf #OffSeq #CubeCart #SSTI #RCE #Vuln

View original post

OffSequence

@offseq

May 14, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-45714
Severity: Critical
CVSS Score: 9.1
Type: template_injection
Status: rejected
EPSS: 4.4%
Social Posts: 2

CWE

CWE-94

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS Score

4.4%Probability of exploitation in the next 30 days