CubeCart v6 before 6.7.0 suffers from an authenticated Server-Side Template Injection vulnerability due to unsafe evaluation of user input in the Smarty template engine without security policies enabled. This flaw affects multiple modules such as Email Templates, Invoices, Documents, and Contact Forms. Exploitation requires administrative privileges and allows arbitrary OS command execution on the server, resulting in remote code execution. The vulnerability is addressed in CubeCart version 6.7.0.

An attacker with administrative privileges can execute arbitrary operating system commands on the server hosting CubeCart, potentially leading to full system compromise, data theft, or disruption of service. The vulnerability affects confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported at this time.

Upgrade CubeCart to version 6.7.0 or later, where this vulnerability is fixed. Since this is an authenticated vulnerability requiring administrative privileges, ensure that administrative access is tightly controlled. Patch status is confirmed fixed in version 6.7.0; no other official remediation level is indicated.