CVE-2026-94104 nivocart CVE debrief

Who should care

Defenders responsible for NivoCart systems, especially those with view-only back-office access, should assess exposure and prioritize remediation. This includes reviewing compensating controls, monitoring for suspicious activity, and updating to a fixed version if available. Verification of affected versions and remediation is necessary to prevent remote code execution.

Why it matters

CVE-2026-94104 is a high-severity vulnerability in NivoCart that allows remote code execution. Defenders should prioritize verifying exposure and remediating this vulnerability, especially in systems with view-only back-office access.

• Remote code execution is possible for attackers with view-only back-office access
• Verification of affected versions and remediation is necessary
• Monitoring for suspicious file uploads and PHP file execution is required
• Updating to a fixed version, if available, is recommended

Technical summary

The vulnerability is caused by the File Manager multi() endpoint failing to validate file extensions for new filenames or when the chunks parameter is 2 or higher. This allows attackers to upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution. The vulnerability is confirmed in NivoCart version 2.4.0 and earlier. Additional information on affected versions and remediation is limited, but defenders should prioritize verifying exposure and remediating this vulnerability, especially in systems with view-only back-office access.

Defensive priority

Defenders should prioritize verifying exposure and remediating this vulnerability, especially in systems with view-only back-office access.

Recommended defensive actions

• Verify exposure by checking for view-only back-office access to the File Manager endpoint
• Remediate by validating file extensions for new filenames and chunks parameter
• Monitor for suspicious file uploads and PHP file execution
• Update to a fixed version, if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is confirmed in NivoCart version 2.4.0 and earlier. The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.