CVE-2026-94104CWE-434unrestricted-file-upload

CVE-2026-94104

High · published September 20, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
51.4
In the wild
Unconfirmed
What it is

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00671 · 51.4th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-09-20T16:17Z
References (5)
https://github.com/nivocart/nivocart · [email protected]https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/filemanager.php#L527-L562 · [email protected]https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/filemanager_full.php · [email protected]https://github.com/nivocart/nivocart/issues/25 · [email protected]https://www.vulncheck.com/advisories/nivocart-through-2.4.0-arbitrary-file-upload-rce-via-filemanager · [email protected]
EPSS history
Timeline
  • 22 SEP 03:44Z
    EPSS moved — → 1%
    epss
  • 20 SEP 11:09Z
    NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager
    cvelistv5