CVE-2023-41788: Remote Code Execution via File Uploader

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-23 · updated 2026-06-17
Weakness: CWE-434

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulnerability allows attackers to execute code via PHP file uploads. This issue affects Pandora FMS: from 700 through 773.

Affected products

Pandora FMS: from 700 before 774 — fixed in 774

How to fix

Upgrade to a fixed version: Pandora FMS 774. Check the vendor advisory for mitigations.

References

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/

Get alerted when CVE-2023-41788 or the next vulnerability affects your stack