CVE-2026-94104

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-94104
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94104.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-94104
Published
2026-09-20T11:09:38Z
Modified
2026-09-26T03:30:37Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager
Details

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-434"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94104.json"
}
References

Affected packages

Git / github.com/nivocart/nivocart

Affected ranges

Type
GIT
Repo
https://github.com/nivocart/nivocart
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6ea6600cda1263ae70c0aab0a70d31091a32c46b
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.0"
        },
        {
            "fixed": "2.4.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v2.*
v2.0.0
v2.1.0
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.3.2
v2.3.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94104.json"