A path traversal weakness (CWE‑22) allows an attacker with administrative privileges to navigate beyond intended directories in CubeCart installations prior to version 6.6.0, potentially viewing or modifying files that should remain hidden. This flaw does not enable arbitrary code execution, but it gives privileged users access to sensitive configuration files or data. The vulnerability is limited to users who already possess admin credentials; attackers must therefore either compromise an account or obtain administrative access through other means.

CubeCart Limited’s CubeCart software, versions earlier than 6.6.0, are affected. Any installation running a pre‑6.6.0 release inherits the path traversal issue.

The flaw carries a CVSS score of 5.1, signifying a moderate severity level. Because the exploit requires administrative access, the likelihood of exploitation is constrained by the ability to compromise admin credentials, and no EPSS data is available or the vulnerability is not listed in KEV. Attackers who gain admin rights can read or overwrite files outside the intended directory tree, potentially exposing confidential data or tampering with configuration. Overall, the risk is moderate but should be mitigated promptly to prevent privileged misuse.