CVE-2026-64950 - Stored Cross-Site Scripting via Directory Name in File Manager Create Directory

Back Back to CVE browser

HIGH

Stored Cross-Site Scripting via Directory Name in File Manager Create Directory

Published Oct 1, 2026

8.4

HIGH

CVSS 4.0

EPSS 0.25%

Description

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards.

Affected products

Vendor Pandora FMS Product Pandora FMS Default
unaffected
- Version
  777
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Pandora FMS

unaffected

Version	Status	Constraints
777	affected	-

Remediation

Vendor solution

Fixed v800.5 and v805

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90599		Advisory
https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner PandoraFMS

Published Oct 1, 2026

Updated Oct 1, 2026

Reserved Jul 21, 2026

Link CVE-2026-64950

CISA Vulnrichment

Updated Oct 1, 2026

NVD

Status Received

Modified Oct 1, 2026

Link CVE-2026-64950

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-64950

ENISA EUVD

Assigner PandoraFMS

Published Oct 1, 2026

Updated Oct 1, 2026

Exploited since n/a

Link EUVD-2026-90599

EUVD-2026-90599