CVE-2026-64946CWE-352CWE-79cross-site-scriptingcsrf
CVE-2026-64946
published October 1, 2026
What it is
A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.
The record
Technical detail
- CVSS
- 7.4 · NONE
- CVSS v4.0
- 7.4 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Amber
- EPSS
- 0.00156 · 4.4th percentile
- Weaknesses
- CWE-352 · Cross-Site Request Forgery (CSRF); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2026-10-01T14:17Z
References (1)
EPSS history
Timeline