CVE-2025-67684

Remote Code Execution via Local File Inclusion in Quick.Cart

Quick.Cart is vulnerable to Local File Inclusion and Path Traversal issues in the theme selection mechanism. Quick.Cart allows a privileged user to upload arbitrary file contents while only validating the filename extension. This allows an attacker to include and execute uploaded PHP code, resulting in Remote Code Execution on the server. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.7 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

We have discovered 345 live websites that are affected by CVE-2025-67684.

Run a Free Instant Scan



Affected Software

Product  Quick.Cart
Category Ecommerce
Vulnerable Domains345 live websites (55% of Quick.Cart install base)
Vulnerable Versions
  • from 6.7 through 6.7
Vulnerable Versions Count1 versions ( 11% of all versions)


Common Weakness Enumeration

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')



Details

  • Published - Jan 22, 2026
  • Updated - Jan 22, 2026

Credits

  • Arkadiusz Marta (finder)

Website Distribution by Country

Number of websites using CVE-2025-67684
United States6 websites


Poland237 websites
Czech Republic27 websites
France16 websites
Hungary12 websites
Germany11 websites
Netherlands9 websites
Slovakia7 websites
Romania5 websites
Denmark4 websites

Website Distribution by TLD

Number of websites using CVE-2025-67684
.pl164 websites
.com43 websites
.cz22 websites
.eu15 websites
.nl9 websites
.de8 websites
.net6 websites
.dk3 websites
.info3 websites
.co.uk2 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2025-67684

Top websites that are affected by CVE-2025-67684. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*****************.de Germany***,***
*******.***.pl Poland***,***
****.************.org Poland***,***
************.com Poland***,***
************.de Germany***,***
***********.hu Hungary*,***,***
*************.pl Poland*,***,***
*******.***.pl Poland*,***,***
*******.****.pl Poland*,***,***
***********.pl Poland*,***,***
See full domain list

FAQ

CVE-2025-67684 is Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Quick.Cart
A total of 345 websites have been identified as vulnerable to CVE-2025-67684, based on global website indexing conducted by WebTechSurvey.
The Quick.Cart is affected by the CVE-2025-67684 vulnerability.
Quick.Cart versions up to and including 6.7 are vulnerable to CVE-2025-67684.