CVE-2023-46845

HIGH

7.2

CVSS Score

Published: November 7, 2023 at 07:39 AM UTC

Updated: June 17, 2026 at 06:31 AM UTC

1 product affected across 1 vendorEc Cube

Using EC-CUBE 4 series by EC-CUBE CO.,LTD.?

Get instant alerts when new vulnerabilities affect EC-CUBE 4 series - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.2

Exploit prediction

EPSS 2%

SSVC

No known exploit

Description

EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where the product is running by a user with an administrative privilege.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ec Cube · Ec Cube

95%

v ≤ 4.2.23.0.0 ≤ v ≤ 3.0.183.0.0 ≤ v ≤ 3.0.18-p64.0.0 ≤ v ≤ 4.0.64.0.0 ≤ v ≤ 4.0.6-p34.1.0 ≤ v ≤ 4.1.24.1.0 ≤ v ≤ 4.1.2-p24.2.0 ≤ v < 4.2.33.0.18 p1 3.0.18 p2 3.0.18 p3 3.0.18 p4 3.0.18 p5 3.0.18 p6 4.0.6 p1 4.0.6 p2 4.0.6 p3 4.1.2 p1 4.1.2 p2

Affected range stops below 4.2.3, so it looks safe — our inference, not a vendor statement