CVE-2026-34018 is a SQL injection in CubeCart versions before 6.6.0, scored critical (CVSS 9.8) in the NVD record. JPCERT/CC lists CubeCart 6.6.0 as the version that fixes it. Upgrade to 6.6.0 or later, then review the database for signs of tampering.
What's affected
The record lists CubeCart versions prior to 6.6.0. JPCERT/CC's notice, JVN#78422311, confirms the same range and says the developer addressed the flaws in CubeCart 6.6.0.
That notice covers three CVEs in one release: an OS command injection by an administrator (CVE-2026-21719), this SQL injection, and a path traversal by an administrator (CVE-2026-35496). One upgrade deals with all three.
The scores differ by source. NVD rates this CVE 9.8 with no privileges and no user interaction. JPCERT/CC lists a CVSS 3.0 base score of 6.3 and marks user interaction as required. Plan around the higher number, since you cannot rule out the worse reading.
How to check if you're exposed
Open the CubeCart admin dashboard and read the version in the footer or the system information page. You can also look at the version constants in the install directory. Anything below 6.6.0 needs the upgrade.
Check your web server and database logs for unusual query errors, or for requests with odd characters in parameters, around the dates you suspect. Note that the advisory does not say which parameter is affected, so log review is a general sweep.
A dynamic scan of a staging copy can also find injectable inputs before an attacker does.
If you have a staging copy, run a dynamic scan against it. Point the scanner only at systems you own, and use a copy of the data, not production records. Injection flaws are what such scans find best, and the result tells you whether the upgrade changed anything.
Keep a record of the version and date you upgraded, so the next advisory is quick to scope.
What to do now
- Back up the store files and the database.
- Upgrade to CubeCart 6.6.0 or later, following the developer's release notes.
- Use a database account with only the rights CubeCart needs, so a SQL flaw cannot drop tables or read other schemas.
- Review recent administrator accounts and orders for changes you did not make.
- Put a web application firewall rule or access restriction in front of the admin area while you upgrade.
- Rotate database credentials if you find signs of misuse.
Why it matters
The weakness is CWE-89, improper neutralization of special elements in an SQL command. When an application builds a query by gluing user input into SQL text, the database cannot tell data from commands. On a store, the database holds orders, customer records and admin accounts.
The record does not say this is exploited in the wild, and it is not on the CISA KEV list. SQL injection is among the most commonly attacked classes, so on an internet-facing shop the fix should not wait.
Treat the scoring difference as a reminder that CVSS is an input, not a verdict. NVD's 9.8 assumes the worst case. JPCERT/CC's lower figure assumes a user has to take part. Both agree on the cure, so the argument matters less than the upgrade.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is 6.6.0 the only fix?
It is the fixed release named by JPCERT/CC. Check the CubeCart release post for anything later.
Sources
Last reviewed: 19 October 2026.
