CVSS 4.0
8.7 highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCVE-2026-94104
High (8.7). EPSS 0.7% chance of exploitation in the next 30 days.
NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.
Severity
CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
- CWE
- CWE-434
- Published
- Modified
- Record from
- the NVD, synced
References
- https://github.com/nivocart/nivocart
- https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/filemanager.php#L527-L562
- https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/filemanager_full.php
- https://github.com/nivocart/nivocart/issues/25
- https://www.vulncheck.com/advisories/nivocart-through-2.4.0-arbitrary-file-upload-rce-via-filemanager