High · 7.4 CVE-2026-64946 EUVD-2026-90593GHSA-8c26-h44h-c9rf

CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager

Published Oct 1, 2026 · Updated Oct 1, 2026 · Assigned by PandoraFMS

Vendor: Pandora FMS Product: Pandora FMS

Description

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.

Affected products

Vendor	Product	Affected	Fixed
Pandora FMS	Pandora FMS	777	—

References

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/