CVE-2026-64949

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards.

  • Published Oct 1, 2026
  • CVSS 8.6 high
  • 0.3% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-64949 at the National Vulnerability Database