PT-2026-103764 · Pandora Fms · Pandora Fms

CVE-2026-64946

·

Published

2026-10-01

·

Updated

2026-10-01

CVSS v4.0

7.4

High

VectorAV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Amber
A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.

Fix

CSRF

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-352CWE-79

Related Identifiers

CVE-2026-64946

Affected Products

Pandora Fms