Vulnerability Description
NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/nivocart/nivocart
- https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c4
- https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c4
- https://github.com/nivocart/nivocart/issues/25
- https://www.vulncheck.com/advisories/nivocart-through-2.4.0-arbitrary-file-uploa
FAQ
What is CVE-2026-94104?
CVE-2026-94104 is a vulnerability with a CVSS score of 8.8 (HIGH). NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or hi...
How severe is CVE-2026-94104?
CVE-2026-94104 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-94104?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.