Executive brief
NivoCart is an open-source shopping cart system that manages product catalogs and orders. The File Manager component fails to validate uploaded file extensions, allowing attackers with low-privilege back-office access to upload malicious PHP files to web-accessible directories and execute them, gaining complete control of the server.
Technical details
The vulnerability exists in the File Manager's multi() endpoint, which does not properly validate file extensions when processing file uploads, particularly when the chunks parameter is 2 or higher. Attackers with view-only back-office credentials can leverage this to upload PHP files to the image/data/ directory and execute arbitrary code with server privileges. A patch is available in versions after 2.4.0.
Affected products
- NivoCart NivoCart through 2.4.0
Timeline
- 2026-09-20: disclosed