OCTOBER 10, 2026
Live Feed
Back to database
Case File

CVE-2026-94104

HIGH · CVSS 8.8 EPSS 0.67% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-20 · Last synced 2026-10-10

CyberRota Analysis

AI-Generated

An arbitrary file upload vulnerability in NivoCart's File Manager allows attackers with view-only back-office access to upload malicious PHP files, leading to potential remote code execution. This flaw arises from inadequate validation of file extensions, particularly when handling file uploads with chunked parameters. Organizations using NivoCart, especially those with back-office access configurations, should prioritize addressing this vulnerability to mitigate the risk of exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
remote code execution code execution
GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-94104
Severity
HIGH
CVSS
8.8
EPSS
0.67%
Office

Original NVD Description

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.