MajorCritical vulnerability

CVE-2026-64950 (CVSS 8.4)

NVD · officialPublished Oct 1, 2026Risk 37/100

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards.

Technical details

CVSS

8.4

AV:NetworkAC:LowPR:HighUI:Passive

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source