The NivoCart application up to version 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint. The flaw occurs because the system does not validate file extensions for new filenames, nor does it enforce restrictions when the chunks parameter is set to 2 or higher. The result is that an attacker with view‑only back‑office access can upload a PHP file to the publicly accessible image/data/ directory and execute it, leading to remote code execution on the host server.

Vulnerable installations are those running NivoCart version 2.4.0 or earlier. The issue was discovered in the filemanager controller and applies to the entire platform, allowing attackers to place uploaded files in the web‑root image/data/ directory without restriction.

The CVSS score of 8.7 indicates high severity, and while an EPSS score is not available, the flaw requires only view‑only back‑office credentials to exploit. The lack of validation and the ability to host executable files in a public directory make this vulnerability readily exploitable for remote attackers. It is not listed in the CISA KEV catalog, but the potential impact remains significant for affected sites.