Arbitrary File Upload Vulnerability in Pandora FMS by Pandora FMS
CVE-2026-64949

8.6HIGH

Key Information:

Vendor

Pandora Fms

Status
Pandora Fms
Vendor
CVE Published:
1 October 2026

What is CVE-2026-64949?

The File Manager module in Pandora FMS is susceptible to a vulnerability that allows authenticated users to bypass the extension blacklist, enabling the upload and execution of arbitrary .phar files. This flaw can lead to unauthorized actions and potentially compromise the integrity of the system. It is essential to address this vulnerability to safeguard against possible exploitation through malicious file uploads.

Affected Version(s)

Pandora FMS all 777

References

https://pandorafms.com/en/security/common-vulnerabilities...

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sagar Gharbudve
.