CVE-2026-64946
HighCVSS 7.4Summary
A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS from version 777 onwards.
Risk Assessment
An attacker can take over the Pandora FMS administrator account, gaining full control over the monitoring system and potentially managed assets. This poses a serious risk to the confidentiality and integrity of the entire infrastructure.
Recommendation
Update Pandora FMS to the latest version that fixes this vulnerability. Until then, restrict access to the File Manager module and implement CSRF protection and SVG upload validation.
Other vulnerabilities in Pandora FMS
See all- CVE-2026-34190Medium
CSRF vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. Affects Pandora FMS from version 777 onwards.
- CVE-2026-34189Medium
CSRF vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. Affects Pandora FMS from version 777 onwards.
- CVE-2026-30810High
Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension. This issue affects Pandora FMS from versions 777 to 800.
- CVE-2026-30808High
Session Fixation vulnerability allows Session Hijacking via crafted session ID. This issue affects Pandora FMS: from 777 through 800.
- CVE-2026-34187Critical
CVE-2026-34187 is a vulnerability related to improper neutralization of special elements used in SQL commands, allowing SQL Injection via graph container parameter. This issue affects Pandora FMS versions from 777 to 800.
- CVE-2026-30805Critical
Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affects Pandora FMS from versions 777 through 800.
- CVE-2025-34088High
An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php script fails to sanitize the select_ips parameter before passing it to system commands, allowing command injection.
- CVE-2026-75786High
Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards.
- CVE-2026-64950High
Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards.
- CVE-2026-64949High
Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards.
Original NVD description (English source)
A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS