CVE-2026-45053

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Arbitrary File Upload vulnerability exists in the REST API File Manager endpoint (POST /api/v1/files) of CubeCart. The endpoint allows any holder of an API key with files:rw permission to upload PHP source files into the web-accessible images/source/ directory, where they are executed by the web server. Combined with a path-traversal flaw in the same endpoint's filepath parameter, a single API request writes a webshell anywhere the webserver process can write — including the document root — yielding full Remote Code Execution. This vulnerability is fixed in 6.7.0.

• CWE-434

• https://github.com/cubecart/v6/security/advisories/GHSA-652f-8c88-25cx
• https://github.com/cubecart/v6/security/advisories/GHSA-652f-8c88-25cx

Published

May 13, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45046Gryph provides a security layer for AI coding agents. Prior …5.5
• CVE-2026-45047bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, th…7.5
• CVE-2026-45048Open Access Management (OpenAM) is an access management solu…8.5
• CVE-2026-4505A vulnerability has been found in eosphoros-ai DB-GPT up to …6.3
• CVE-2026-45051Open Access Management (OpenAM) is an access management solu…9.2
• CVE-2026-45052Open Access Management (OpenAM) is an access management solu…9.3
• CVE-2026-45054CubeCart is an ecommerce software solution. Prior to 6.7.0, …4.9
• CVE-2026-45055CubeCart is an ecommerce software solution. Prior to 6.7.2, …8.1
• CVE-2026-45056matrix-sdk-crypto is a no-network-IO implementation of a sta…6.9
• CVE-2026-45057matrix-sdk-ui provides GUI-centric utilities on top of matri…4.9
• CVE-2026-45058electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…9.4
• CVE-2026-4506A vulnerability was found in Mindinventory MindSQL up to 0.2…6.3