Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Arbitrary File Upload vulnerability exists in the REST API File Manager endpoint (POST /api/v1/files) of CubeCart. The endpoint allows any holder of an API key with files:rw permission to upload PHP source files into the web-accessible images/source/ directory, where they are executed by the web server. Combined with a path-traversal flaw in the same endpoint's filepath parameter, a single API request writes a webshell anywhere the webserver process can write — including the document root — yielding full Remote Code Execution. This vulnerability is fixed in 6.7.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-45053 Authenticated Arbitrary File Upload and Path Traversal Remote Code Execution in CubeCart Below 6.7.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45053
Post summary
The text announces CVE‑2026‑45053, detailing its RCE capabilities via arbitrary file upload and path traversal in CubeCart versions below 6.7.0, without referencing PoC, exploitation, or remediation.
CVE-2026-45053 CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Arbitrary File Upload vulnerability exists in the REST API File Manager endpoint (POST /a… https://www.cve.org/CVERecord?id=CVE-2026-45053
Post summary
CVE-2026-45053 describes an authenticated arbitrary file upload flaw in CubeCart’s REST API File Manager endpoint; no exploit, patch, or exploitation evidence is provided.