CVE-2021-36697

MediumCVSS 6.7

Published: 03/11/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

A vulnerability in Artica Pandora FMS up to version 755 allows an admin to overwrite the .htaccess file via the File Manager component. The new .htaccess contains a Rewrite Rule with a file type definition, enabling upload of a normal PHP file and code execution via an HTTP request.

Risk Assessment

The risk involves authenticated remote code execution by an admin, potentially leading to full server compromise and data breach.

Recommendation

Immediately upgrade Pandora FMS to a version newer than 755 and restrict admin privileges to the minimum necessary.

Original NVD description (English source)

With an admin account, the .htaccess file in Artica Pandora FMS <=755 can be overwritten with the File Manager component. The new .htaccess file contains a Rewrite Rule with a type definition. A normal PHP file can be uploaded with this new "file type" and the code can be executed with an HTTP request.