High · 7.5 CVE-2026-64947 EUVD-2026-90596GHSA-cqqp-fqm5-2w6f

CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager

Published Oct 1, 2026 · Updated Oct 1, 2026 · Assigned by PandoraFMS

Vendor: Pandora FMS Product: Pandora FMS

Description

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards.

Affected products

Vendor	Product	Affected	Fixed
Pandora FMS	Pandora FMS	777	—

References

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/