CVE-2026-94104: NivoCart File Upload RCE Vulnerability

CVE-2026-94104 Overview

CVE-2026-94104 is an arbitrary file upload vulnerability [CWE-434] affecting NivoCart through version 2.4.0. The flaw resides in the File Manager multi() endpoint, which fails to validate file extensions when new filenames are supplied or when the chunks parameter is set to 2 or higher. An attacker with view-only back-office access can upload PHP files to the web-accessible image/data/ directory. Requesting the uploaded file then triggers remote code execution under the web server context. The vulnerability affects the open-source NivoCart e-commerce platform and is documented in the VulnCheck Advisory on NivoCart.

Critical Impact
Low-privileged back-office users can achieve unauthenticated-equivalent remote code execution on the underlying web server, leading to full compromise of the storefront and its data.

Affected Products

NivoCart versions up to and including 2.4.0
NivoCart admin File Manager component (upload/admin/controller/common/filemanager.php)
NivoCart admin File Manager Full component (upload/admin/controller/common/filemanager_full.php)

Discovery Timeline

2026-09-20 - CVE-2026-94104 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-94104

Vulnerability Analysis

NivoCart exposes a File Manager endpoint at admin/controller/common/filemanager.php intended for uploading images and product assets. The multi() handler accepts chunked uploads and supports client-supplied filenames. Extension validation is performed only on the initial chunk when a new filename is not provided by the client. When a caller supplies an arbitrary filename or sets chunks to a value of 2 or higher, the extension check is skipped entirely. The uploaded content is written to image/data/, a directory served directly by the web server. Because the storage path executes PHP, any uploaded .php file becomes callable over HTTP.

The issue is compounded by the permissive back-office role model. Accounts granted view-only privileges retain access to the File Manager controller, so the pre-authentication barrier is minimal in environments that share admin credentials or expose low-tier operator accounts.

Root Cause

The root cause is missing server-side validation of the file extension and MIME type on the write path. The controller trusts client-controlled name and chunks request parameters when deciding whether to enforce allow-list checks. This is a textbook Unrestricted Upload of File with Dangerous Type weakness [CWE-434]. The upload target directory also lacks execution restrictions, allowing PHP interpretation of attacker-supplied files. See the relevant handler at the GitHub File Manager Code.

Attack Vector

An attacker authenticates to the NivoCart back office with any account that can reach the File Manager, including view-only roles. The attacker issues a multipart POST request to the File Manager multi() endpoint supplying a .php filename or a chunks value of 2 or higher. The server writes the payload to image/data/. The attacker then requests the resulting URL to execute arbitrary PHP under the web server user. Public references, including the GitHub Issue Tracker #25, describe the request flow.

Detection Methods for CVE-2026-94104

Indicators of Compromise

Presence of .php, .phtml, or other server-executable files inside the image/data/ directory or its subfolders.
Web server access log entries showing POST requests to the admin File Manager multi() endpoint followed by GET requests to newly created files under image/data/.
Outbound network connections from the PHP-FPM or Apache worker process to unexpected destinations shortly after File Manager activity.
New admin sessions from unusual IP addresses that immediately navigate to File Manager routes.

Detection Strategies

Alert on any file with an executable extension written under image/data/ using file integrity monitoring.
Correlate authenticated admin requests to filemanager.php or filemanager_full.php with subsequent requests to files under image/data/ from the same or different source IPs.
Flag multipart uploads to the File Manager where the chunks parameter is 2 or higher and the target filename ends in a scripting extension.

Monitoring Recommendations

Ingest web server access and error logs into a centralized analytics platform and retain them for at least 90 days.
Monitor process trees from the PHP worker for spawned shells such as /bin/sh, bash, nc, or curl executions.
Track admin account provisioning changes and enumerate all users with access to File Manager routes.

How to Mitigate CVE-2026-94104

Immediate Actions Required

Restrict network access to the /admin path to trusted IP ranges or a VPN until a fix is applied.
Audit all admin accounts and disable any that do not require File Manager access.
Inspect the image/data/ directory tree for unauthorized .php or other executable files and remove them after preserving forensic copies.
Rotate admin credentials and any secrets accessible to the web server after remediation.

Patch Information

No vendor patch is referenced in the enriched advisory data at the time of publication. Track the GitHub NivoCart Repository and the GitHub Issue Tracker #25 for a fixed release. Upgrade to a version above 2.4.0 once the maintainer publishes a build that enforces extension validation on all chunked upload paths.

Workarounds

Configure the web server to deny script execution in image/data/ by dropping a .htaccess with php_flag engine off (Apache) or an equivalent location block that disables PHP handling (Nginx).
Remove or comment out the multi() handler in upload/admin/controller/common/filemanager.php if File Manager functionality is not required.
Enforce a server-side allow-list of image extensions (.jpg, .jpeg, .png, .gif, .webp) and validate MIME type via finfo before writing uploads.
Place the admin interface behind an authenticating reverse proxy or web application firewall that blocks multipart uploads to File Manager routes for non-privileged users.

bash

# Apache: disable PHP execution in the upload directory
cat > /var/www/nivocart/image/data/.htaccess <<'EOF'
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7|pht)$">
    Require all denied
</FilesMatch>
php_flag engine off
EOF

# Nginx: add to server block
# location ^~ /image/data/ {
#     location ~ \.ph(p[3457]?|t|tml|ar)$ { deny all; return 403; }
# }