CVE-2026-94104 Details

An arbitrary file upload vulnerability has been identified in NivoCart versions through 2.4.0. The issue resides in the File Manager's 'multi()' endpoint, which fails to properly validate file extensions for new filenames or when the 'chunks' parameter is set to 2 or higher. This vulnerability allows attackers with view-only back-office access to upload PHP files to the web-accessible 'image/data/' directory and execute them, leading to remote code execution.

To address this vulnerability, NivoCart should implement strict and unconditional validation of file extensions and MIME types before saving any uploaded files or chunks. Additionally, the 'multi()' endpoint should include a permission check to ensure that only users with the appropriate rights can upload files. Finally, web server configurations should be updated to prevent the execution of scripts in upload directories, such as 'image/data/'.