CVE-2026-45053— CubeCart 代码问题漏洞

CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Arbitrary File Upload vulnerability exists in the REST API File Manager endpoint (POST /api/v1/files) of CubeCart. The endpoint allows any holder of an API key with files:rw permission to upload PHP source files into the web-accessible images/source/ directory, where they are executed by the web server. Combined with a path-traversal flaw in the same endpoint's filepath parameter, a single API request writes a webshell anywhere the webserver process can write — including the document root — yielding full Remote Code Execution. This vulnerability is fixed in 6.7.0.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

危险类型文件的不加限制上传

CubeCart 代码问题漏洞

CubeCart是CubeCart开源的一个电子商务软件。 CubeCart 6.7.0之前版本存在代码问题漏洞，该漏洞源于REST API文件管理器端点允许持有API密钥的用户上传PHP源文件到web可访问目录，结合路径遍历漏洞，可能导致远程代码执行。

N/A

N/A