CVE-2023-41812: Uploading executables via the file manager

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-23 · updated 2026-06-17
Weakness: CWE-434

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulnerability allowed PHP executable files to be uploaded through the file manager. This issue affects Pandora FMS: from 700 through 773.

Affected products

Pandora FMS: from 700 before 774 — fixed in 774

How to fix

Upgrade to a fixed version: Pandora FMS 774. Check the vendor advisory for mitigations.

References

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/

Get alerted when CVE-2023-41812 or the next vulnerability affects your stack