CubeCart modules such as Email Templates allow authenticated administrators to inject arbitrary text that is interpreted by the Smarty engine. The engine executes the supplied template, enabling the attacker to invoke native PHP functions like readgzfile or error_log. This leads to unauthorized information disclosure and full remote code execution, compromising the entire storefront.

CubeCart version 6 prior to 6.7.0 is affected, especially modules dealing with email notifications and document generation. The issue is present in all repository commits before the 6.7.0 release, as referenced by the GitHub commit and advisory.

The CVSS score of 9.1 places the issue in the Critical range, and no EPSS data is available. The vulnerability requires administrative authentication, so it is considered a high exploitation effort internally. There is no record of exploitation in CISA KEV. Attackers would need to log in as an admin and supply crafted template content to trigger code execution.