CVE-2026-64946

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.

  • Published Oct 1, 2026
  • CVSS 7.4 high
  • 0.2% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-64946 at the National Vulnerability Database