CVE-2026-64947 - CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager

Back Back to CVE browser

HIGH

CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager

Published Oct 1, 2026

7.5

HIGH

CVSS 4.0

EPSS 0.25%

Description

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards.

Affected products

Vendor Pandora FMS Product Pandora FMS Default
unaffected
- Version
  777
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Pandora FMS

unaffected

Version	Status	Constraints
777	affected	-

Remediation

Vendor solution

Fixed v800.5 and v805

Weaknesses (2)

CWE-352

CSRF

CWE-434

Unrestricted Upload of File

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90596		Advisory
https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner PandoraFMS

Published Oct 1, 2026

Updated Oct 1, 2026

Reserved Jul 21, 2026

Link CVE-2026-64947

CISA Vulnrichment

Updated Oct 1, 2026

NVD

Status Received

Modified Oct 1, 2026

Link CVE-2026-64947

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-64947

ENISA EUVD

Assigner PandoraFMS

Published Oct 1, 2026

Updated Oct 1, 2026

Exploited since n/a

Link EUVD-2026-90596

EUVD-2026-90596