CVE-2026-64949CWE-434unrestricted-file-upload

CVE-2026-64949

published October 1, 2026

CVSS
8.6
EPSS
0%
Percentile
21.6
In the wild
Unconfirmed
What it is

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards.

The record
Technical detail
CVSS
8.6 · NONE
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:N/AU:Y/R:I/V:C/RE:M/U:Red
EPSS
0.00300 · 21.6th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-10-01T14:17Z
References (1)
https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ · [email protected]
EPSS history
Timeline
  • 03 OCT 03:45Z
    EPSS moved — → 0%
    epss
  • 01 OCT 09:29Z
    Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager
    cvelistv5