CVE-2026-64946: CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager

Published Oct 1, 2026

Updated

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.

Affected Software

1 affected component

Pandora FMS Pandora FMS>=777

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Pandora FMS to a version that resolves this vulnerability.
Fixed in 800.5
Upgrade
Upgrade Pandora FMS to a version that resolves this vulnerability.
Fixed in 805

Event History

Oct 1, 2026

CVE Published

via MITRE·09:26 AM

Data Sourced

via MITRE·09:26 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Pandora FMS deployments from version 777 onwards are affected, specifically where the File Manager module is available to process uploaded files.

What must an attacker do to exploit the vulnerability?

The attack relies on chaining a CSRF bypass with an unrestricted SVG upload through the File Manager module. A successful upload can result in stored cross-site scripting.

What is the likely impact of successful exploitation?

Stored script execution can exfiltrate session cookies and enable administrator account takeover.