CVE-2026-45708 is a code injection vulnerability (CWE-94) in CubeCart ecommerce software versions before 6.7.3. An administrator with document editing rights can inject raw PHP code into the Invoice Editor. When any admin prints an order, the injected code is saved as a PHP file under files/print.<md5>.php. The .htaccess configuration explicitly allows access to these files, enabling unauthenticated remote users to execute arbitrary PHP code on the server. This vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity. The issue is resolved in CubeCart version 6.7.3.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary PHP code on the server hosting CubeCart, potentially leading to full system compromise, data theft, or service disruption. The vulnerability requires an admin with document edit permissions to inject the code, but once injected, any unauthenticated visitor can trigger execution by accessing the generated PHP file.

Upgrade CubeCart to version 6.7.3 or later, where this vulnerability is fixed. Until the upgrade, restrict admin document edit permissions to trusted users only. Patch status is confirmed fixed in 6.7.3. No vendor advisory was provided, but the description explicitly states the fix version.