Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-94104— NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager

Quick assessment

Affected
nivocart nivocart
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

NivoCart 2.4.0 及之前版本存在任意文件上传漏洞，其文件管理器中的 端点在以下情况下未对文件扩展名进行有效验证： 1. 当用户指定新的文件名时； 2. 当 参数值大于或等于 2 时。 拥有仅查看权限的后台（back-office）访问权限的攻击者可以利用此漏洞，向可通过 Web 访问的 目录上传 PHP 文件，并执行这些文件，从而实现远程代码执行（RCE）。

CVSS 8.8 · High

Possible ATT&CK Techniques 1 AI

T1105 · Ingress Tool Transfer
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-94104

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager
Source: CVE Program / CVE List V5
Vulnerability Description
NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nivocart nivocart 0 ~ 2.4.0 -

II. Public POCs for CVE-2026-94104

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-94104

请登录查看更多情报信息。

Other References for CVE-2026-94104 (4)

Same Patch Batch · nivocart · 2026-09-20 · 3 CVEs total

CVE-2026-94107 8.1 HIGH NivoCart through 2.4.0 Predictable Administrator Password Reset Token
CVE-2026-94105 5.3 MEDIUM NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller

IV. Related Vulnerabilities

Same product: nivocart
Same vendor: nivocart
Same weakness: CWE-434

V. Comments for CVE-2026-94104

No comments yet

Leave a comment