This vulnerability in CubeCart prior to version 6.6.0 involves improper limitation of pathname inputs, enabling an administrator-level user to traverse to higher-level directories outside the intended restricted directory. The CVSS score of 2.7 reflects low impact, with the attack vector being network-based, requiring high privileges, and resulting in limited confidentiality impact without integrity or availability effects. No vendor advisory or patch information is currently provided.

An attacker with administrative privileges can exploit this vulnerability to access files and directories outside the intended scope, potentially exposing sensitive information stored in higher-level directories. However, the impact is limited to confidentiality and does not affect system integrity or availability. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted users only and monitor for any unusual directory access patterns. Avoid exposing administrative interfaces to untrusted networks.