CVE-2026-94104
NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 20, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 20, 2026
Description
NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
nivocartnivocart |
|
References
- GitHub Issue #25issue-tracking
- multi() upload path at v2.4.0technical-description
- duplicated file manager controller at v2.4.0technical-description
- https://github.com/nivocart/nivocartproduct
- VulnCheck Advisory: NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanagerthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.