CVE-2026-44377 is a critical authenticated Server-Side Template Injection vulnerability in CubeCart v6 before 6.7.0. The application unsafely evaluates user-supplied input through the Smarty template engine in multiple modules. An attacker with administrative privileges can bypass restrictions to invoke native PHP functions such as readgzfile() and error_log(), enabling reading of sensitive configuration files and writing of malicious PHP web shells. This leads to high-impact consequences including information disclosure and remote code execution. The vulnerability is fixed in version 6.7.0.

Successful exploitation allows an authenticated attacker with administrative privileges to execute arbitrary PHP code on the server, resulting in full remote code execution and information disclosure. This compromises confidentiality, integrity, and availability of the affected system.

Upgrade CubeCart to version 6.7.0 or later, where this vulnerability is fixed. Patch status is confirmed by the vendor's versioning. No other mitigation guidance is provided or required beyond applying the official fix.