MinorCritical vulnerability
CVE-2026-64946 (CVSS 7.4)
NVD · officialPublished Oct 1, 2026Risk 23/100
A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.
Technical details
CVSS
7.4
AV:NetworkAC:LowPR:NoneUI:Active
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source