CVE-2026-64947
7.5
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:N/AU:Y/R:I/V:C/RE:H/U:Red
Summary
A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Pandora FMS | Pandora FMS | 777 | affected |
Weaknesses
- CWE-434: CWE-434 Unrestricted upload of file with dangerous type
- CWE-352: CWE-352 Cross-Site request forgery (CSRF)
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.