CVE-2026-64947: CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager

Severity: high (CVSS 7.5 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-01 · updated 2026-10-01
Weakness: CWE-352

Description

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards.

Affected products

Pandora FMS: 777

References

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/

Get alerted when CVE-2026-64947 or the next vulnerability affects your stack