Vulnerability · Published Sep 20, 2026 · Assigned by VulnCheck
CVE-2026-94104NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager
High 8.8
In plain English
A high-severity unrestricted file upload in nivocart from nivocart. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.7%top 47.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Issue #25 issue-tracking
- multi() upload path at v2.4.0 technical-description
- duplicated file manager controller at v2.4.0 technical-description
- https://github.com/nivocart/nivocart product
- VulnCheck Advisory: NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager third-party-advisory