CVE-2026-64947

UNKNOWN 0.0

CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards.

CWE	CWE-434 CWE-352
Vendor	pandora fms
Product	pandora fms
Published	Oct 1, 2026

Stay Ahead of the Next One

Get instant alerts for pandora fms pandora fms

Be the first to know when new unknown vulnerabilities affecting pandora fms pandora fms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Pandora FMS / Pandora FMS

777

References

NVD ↗ CVE.org ↗ EPSS Data ↗

pandorafms.com: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/

Credits

Gaurish Kauthankar (Argon21) & Mr. Omkar Naik