PT-2026-103768 · Pandora Fms · Pandora Fms

Ankit Singh

·

CVE-2026-64950

·

Published

2026-10-01

·

Updated

2026-10-01

CVSS v4.0

8.4

High

VectorAV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:L/U:Amber
Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards.

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-64950

Affected Products

Pandora Fms