CVEvulnerability

CVE-2026-64947

7.5 HIGH Published 2026-10-01 Modified 2026-10-01 Official page ↗

Status: Deferred
Published: 2026-10-01
Last modified: 2026-10-01
Assigner: [email protected]
CVSS 4.0 ([email protected]): 7.5 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:I/V:C/RE:H/U:Red
Weaknesses: CWE-352, CWE-434

Description

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards.

Weakness · CWE (2)

CWE-352 Cross-Site Request Forgery weakness
CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ pandorafms.com

CVE-2026-64947

Description

Related

Weakness · CWE (2)

References