CubeCart’s REST API file upload endpoint (POST /api/v1/files) allows an attacker who holds an API key with files:rw permission to upload PHP source files into a publicly accessible directory. The upload can be combined with a path‑traversal flaw in the filepath parameter, enabling a single request to place a web-shell anywhere the server can write, including the document root, thus executing arbitrary code. The vulnerability is identified as a CWE‑434.

Any CubeCart v6 installation with a version older than 6.7.0 is affected, as the issue was resolved in version 6.7.0.

The CVSS score of 9.1 marks the issue as critical. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access via a valid API key with files:rw permission; once such a key is in possession, the path‑traversal component allows the attacker to place files outside the intended directory, providing a straightforward path to remote code execution.