CVE-2026-64947 - CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager

Back Back to CVE browser

HIGH

CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager

Published Oct 1, 2026

7.5

HIGH

CVSS 4.0

EPSS 0.25%

Description

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards.

Affected products

Vendor Pandora FMS Product Pandora FMS Default
unaffected
Affected
- 777

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Pandora FMS	Pandora FMS	unaffected	Affected 777

Remediation

Vendor solution

Fixed v800.5 and v805

Weaknesses (2)

CWE-352

CSRF

CWE-434

Unrestricted Upload of File

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90596		Advisory
https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner PandoraFMS

Published Oct 1, 2026

Updated Oct 1, 2026

Reserved Jul 21, 2026

Link CVE-2026-64947

CISA Vulnrichment

Updated Oct 1, 2026

NVD

Status Received

Modified Oct 1, 2026

Link CVE-2026-64947

Red Hat

No data

ENISA EUVD

Assigner PandoraFMS

Published Oct 1, 2026

Updated Oct 1, 2026

Link EUVD-2026-90596

GitHub

No data