CVE-2026-45053

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Arbitrary File Upload vulnerability exists in the REST API File Manager endpoint (POST /api/v1/files) of CubeCart. The endpoint allows any holder of an API key with files:rw permission to upload PHP source files into the web-accessible images/source/ directory, where they are executed by the web server. Combined with a path-traversal flaw in the same endpoint's filepath parameter, a single API request writes a webshell anywhere the webserver process can write — including the document root — yielding full Remote Code Execution. This vulnerability is fixed in 6.7.0.

• CWE-434

• https://github.com/cubecart/v6/security/advisories/GHSA-652f-8c88-25cx
• https://github.com/cubecart/v6/security/advisories/GHSA-652f-8c88-25cx

Published

May 13, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45043RustFS is a distributed object storage system built in Rust.…9.3
• CVE-2026-45044RustFS is a distributed object storage system built in Rust.…8.8
• CVE-2026-45045Fiber is an Express inspired web framework written in Go. Pr…5.3
• CVE-2026-45046Gryph provides a security layer for AI coding agents. Prior …5.5
• CVE-2026-45047bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, th…7.5
• CVE-2026-4505A vulnerability has been found in eosphoros-ai DB-GPT up to …6.3
• CVE-2026-45054CubeCart is an ecommerce software solution. Prior to 6.7.0, …4.9
• CVE-2026-45055CubeCart is an ecommerce software solution. Prior to 6.7.2, …8.1
• CVE-2026-45058electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…9.4
• CVE-2026-4506A vulnerability was found in Mindinventory MindSQL up to 0.2…6.3
• CVE-2026-45060ClipBucket v5 is an open source video sharing platform. Prio…9.8
• CVE-2026-45061Budibase is an open-source low-code platform. Prior to 3.35.…7.7