An authenticated administrator with permission to edit documents can inject raw PHP into the Invoice Editor. When the administrator later prints an order, the injected code is written to a temporary file that is executed by any user who accesses the URL. The flaw permits attackers to run arbitrary code on the server, compromising confidentiality, integrity, and availability. The weakness is a classic code injection reflected in CWE‑94.

CubeCart version 6 and earlier, up to but not including 6.7.3. All installations that did not upgrade to the patched release are vulnerable.

The CVSS score of 7.2 indicates a high severity vulnerability. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires an administrator with edit permissions, after which an unauthenticated user can trigger the execution by requesting the dynamically generated PHP file. The likelihood of exploitation depends on the presence of privileged users, but once the conditions are met the attack is straightforward.