High · 8.7 CVE-2026-30809 EUVD-2026-21990GHSA-9w52-f5xp-pq4c

OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution

Published Apr 13, 2026 · Updated Apr 13, 2026 · Assigned by PandoraFMS

Vendor: Pandora FMS Product: Pandora FMS

Description

Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via WebServerModuleDebug. This issue affects Pandora FMS: from 777 through 800

Affected products

Vendor	Product	Affected	Fixed
Pandora FMS	Pandora FMS	777 – ≤ 800	—

References

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/