High severity8.8NVD Advisory· Published Sep 20, 2026· Updated Sep 24, 2026
CVE-2026-94104
CVE-2026-94104
Description
NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/filemanager.phpnvd
- github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/filemanager_full.phpnvd
- github.com/nivocart/nivocart/issues/25nvd
- www.vulncheck.com/advisories/nivocart-through-2.4.0-arbitrary-file-upload-rce-via-filemanagernvd
News mentions
0No linked articles in our index yet.