Chained CSRF and Unrestricted SVG Upload Vulnerability in Pandora FMS
CVE-2026-64946

7.4HIGH

Key Information:

Vendor: Pandora Fms
Status: Pandora Fms
Vendor: CVE Published:; 1 October 2026

🔔 Create Pandora Fms Vulnerability Alert

What is CVE-2026-64946?

The vulnerability in the File Manager module of Pandora FMS arises from a combination of chained Cross-Site Request Forgery (CSRF) and unrestricted file upload of SVG files. This flaw allows attackers to upload malicious files, which can then lead to stored Cross-Site Scripting (XSS) exploits. Through this attack vector, sensitive session cookies can be exfiltrated, potentially enabling unauthorized access to administrator accounts. This issue is particularly concerning for users on versions from 777 onwards, emphasizing the need for prompt remediation strategies to safeguard against such exploits.

Affected Version(s)

Pandora FMS all 777

References

https://pandorafms.com/en/security/common-vulnerabilities...

CVSS V4

Score:

7.4

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

Physical

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 1, 2026
Vulnerability Reserved
Jul 21, 2026

Credit

Gaurish Kauthankar (Argon21) & Mr. Omkar Naik

CVE-2026-64946 Data

JSON