CVE-2026-64949: Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager

Published Oct 1, 2026

Updated

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards.

Affected Software

1 affected component

Pandora FMS Pandora FMS>=777

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Pandora FMS to a version that resolves this vulnerability.
Fixed in v800.5
Upgrade
Upgrade Pandora FMS to a version that resolves this vulnerability.
Fixed in v805

Event History

Oct 1, 2026

CVE Published

via MITRE·09:29 AM

Data Sourced

via MITRE·09:29 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated and have the high privileges reflected in the CVSS vector. The issue is in the Admin Tools File Manager, so exposure depends on access to that administrative functionality.

Which deployments are affected?

Pandora FMS versions from 777 onwards are identified as affected. The provided information does not state whether the vulnerable File Manager functionality is enabled or accessible in a default deployment.

What is the impact after successful exploitation?

A successful attacker can upload and execute an arbitrary .phar file, leading to remote code execution. The CVSS vector indicates high impact to confidentiality, integrity, and availability of the vulnerable system.

CVE-2026-64949: Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What is the impact after successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What is the impact after successful exploitation?