An OS command injection vulnerability exists in CubeCart prior to version 6.6.0. This flaw permits an attacker who has administrative privileges to execute arbitrary OS commands on the underlying system. The vulnerability is classified as high severity with a CVSS 3.0 base score of 7.2, indicating network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available to confirm remediation status.

Successful exploitation allows an authenticated administrator to execute arbitrary operating system commands, potentially leading to full system compromise including unauthorized data access, modification, or service disruption. The vulnerability affects all CubeCart installations prior to version 6.6.0.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted users only and monitor for suspicious activity related to command execution. Avoid exposing administrative interfaces to untrusted networks.