CVE-2026-64946

UNKNOWN 0.0

CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.

CWE	CWE-79 CWE-352
Vendor	pandora fms
Product	pandora fms
Published	Oct 1, 2026

Stay Ahead of the Next One

Get instant alerts for pandora fms pandora fms

Be the first to know when new unknown vulnerabilities affecting pandora fms pandora fms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Pandora FMS / Pandora FMS

777

References

NVD ↗ CVE.org ↗ EPSS Data ↗

pandorafms.com: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/

Credits

Gaurish Kauthankar (Argon21) & Mr. Omkar Naik