Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-94104: NivoCart up to 2.4.0 allows uploaded files to run code
CVE-2026-94104 · published 9 days ago
Summary
If someone with view‑only back‑office access logs in, they can place a script file in the public image folder and make the server run it. This could let an attacker take control of the web site. Upgrade NivoCart past version 2.4.0 or disable the file‑manager upload feature and limit file types to safe images.
Original advisory text
NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager
NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.
References
- https://github.com/nivocart/nivocart
- https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c4...
- https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c4...
- https://github.com/nivocart/nivocart/issues/25
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94104... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-94104 Vendor Advisory
- https://www.vulncheck.com/advisories/nivocart-through-2.4.0-arbitrary-file-uploa...
Severity
8.7
High
CVSS 3.1: 8.8 (NVD)
CVSS 4.0: 8.7 (NVD)
Exploitation
EPSS <1%
Type
CWE-434Unrestricted File Upload
Timeline
Published20 Sep 2026
Updated27 Sep 2026
First seen20 Sep 2026
Track software like this
Free during beta