Arbitrary File Upload in NivoCart Leading to Remote Code Execution

Executive Summary

CVE-2026-94104 is an arbitrary file upload vulnerability in NivoCart through version 2.4.0. It affects the File Manager's multi() endpoint, which fails to validate file extensions for new filenames or when the chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized PHP files in the web-accessible image/data/ directory. Review file manager logs for suspicious uploads with chunks parameter set to 2 or higher. Inspect file extensions in uploads to ensure only allowed types are present.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to upload and execute malicious PHP files on the server, leading to remote code execution. This could result in unauthorized access to sensitive data, system compromise, or further attacks within the network. Attackers could also manipulate or delete files, disrupt services, or escalate privileges depending on server configuration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, unauthorized access to personal or sensitive data, and system compromise. Such incidents may violate GDPR (data protection), HIPAA (health information), or other regulations, resulting in legal penalties, fines, reputational damage, and mandatory breach notifications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update NivoCart to the latest version beyond 2.4.0. Disable the file manager multi() endpoint if not required. Implement strict file extension validation for uploads. Restrict back-office access to trusted users only.

Useful 0 Not Useful 0