CVE-2026-94104: NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager
NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs view-only back-office access. No user interaction is required once that access is available, and exploitation can be performed remotely over the network.
Are default deployments affected?
The issue affects NivoCart through 2.4.0 where the File Manager multi() endpoint is available to a view-only back-office user. The supplied data does not identify any additional configuration prerequisite.
What must an attacker do to obtain code execution?
The attacker uploads a PHP file through the File Manager multi() endpoint, using a new filename or a request with the chunks parameter set to 2 or greater. Because uploaded files are placed in the web-accessible image/data/ directory, the attacker can request the PHP file to execute it.
How can defenders assess whether exploitation may have occurred?
Review the web-accessible image/data/ directory for unexpected PHP files and inspect File Manager upload activity associated with back-office accounts, particularly view-only accounts. Pay particular attention to uploads using new filenames or a chunks value of 2 or higher.