CVE-2026-64947: CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager
Published Oct 1, 2026
·Updated
A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards.
Affected Software
1 affected component
Pandora FMS Plugin File Manager>=777
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pandora FMSto a version that resolves this vulnerability.Fixed in v800.5 - Upgrade
Upgrade
Pandora FMSto a version that resolves this vulnerability.Fixed in v805
Event History
Oct 1, 2026
CVE Published
via MITRE·09:27 AM
Data Sourced
via MITRE·09:27 AM
RemedyDescriptionWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Pandora FMS deployments using Plugin File Manager are affected from version 777 onwards.
2
What does an attacker need to achieve remote code execution?
The issue is a chain of a CSRF bypass and unrestricted file upload. Successful exploitation allows an attacker to upload and execute arbitrary PHP code.