CVE-2026-35496: Cubecart

Medium severity, CVSS 5.1. EPSS: 0.4% chance of exploitation in the next 30 days.

A path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to access higher-level directories that should not be accessible.

Affected products

• Cubecart Cubecart: before 6.6.0 (fixed in 6.6.0)

Published 2026-04-17. Last modified 2026-06-17.