Skip to content
OpenAdvisories
High · 8.4 CVE-2026-64950 EUVD-2026-90599GHSA-wqwc-mc6v-2fqc

Stored Cross-Site Scripting via Directory Name in File Manager Create Directory

Published Oct 1, 2026 · Updated Oct 1, 2026 · Assigned by PandoraFMS

Description

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards.

Affected products

VendorProductAffectedFixed
Pandora FMS Pandora FMS 777 —

References