CVE-2026-64946 in Pandora FMS
Summary
by MITRE • 10/01/2026
A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The identified security flaw represents a critical combination of two distinct vulnerabilities within the File Manager module of Pandora FMS versions starting from build 777. The primary technical deficiency lies in the unrestricted file upload mechanism, which fails to adequately validate or sanitize SVG files submitted by authenticated users. While many systems restrict uploads based on MIME types or extensions, this implementation allows an attacker to bypass these checks and store maliciously crafted Scalable Vector Graphics (SVG) files directly onto the server's filesystem. Because SVG is an XML-based format that supports JavaScript execution in modern web browsers, a stored payload embedded within such a file can be executed when rendered by a victim user’s browser. This flaw aligns with CWE-436, which describes interpretation ambiguity during parsing of ambiguous input formats like XML or HTML, and falls under the broader category of CWE-79, known as Cross-Site Scripting (XSS).
The severity of this vulnerability is significantly amplified by its chaining capability with a Cross-Site Request Forgery attack. Although CSRF protection mechanisms may exist for standard form submissions, they are often bypassed or absent in specific file upload endpoints that rely on session cookies for authentication without requiring additional anti-CSRF tokens. An attacker can craft a malicious webpage containing an SVG payload and trick an authenticated administrator into visiting it while logged into the Pandora FMS interface. When the browser renders the image to display the content, the embedded JavaScript executes within the context of the victim’s active session. This execution environment grants the script full access to sensitive cookies, local storage, and DOM elements associated with the application. Consequently, this leads directly to CWE-384, Session Fixation or Cookie Theft, allowing the attacker to exfiltrate authentication tokens that can be replayed to hijack the administrator’s account entirely.
From an operational perspective, the impact of this vulnerability is catastrophic for organizations relying on Pandora FMS for infrastructure monitoring and security management. Successful exploitation results in a complete compromise of administrative privileges, enabling the adversary to manipulate system configurations, alter monitored assets, inject false alerts or silence critical warnings, and potentially pivot further into the internal network using credentials obtained from the application database. This scenario maps closely to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically through browser-based execution via XSS, as well as T1534, Internal Spearphishing if used in a targeted campaign against specific personnel. The ability to take over an admin account also facilitates lateral movement and persistence within the monitored environment, undermining the integrity of the entire security monitoring posture.
Mitigation strategies must address both the input validation failure and the session management weaknesses immediately. Administrators should apply any available vendor patches that restrict file upload types to exclude SVG or enforce strict MIME type verification on the server side rather than relying solely on client-side checks. If patching is not immediately feasible, implementing a Web Application Firewall rule set can help block requests containing suspicious XML structures or script tags within uploaded files. Additionally, enforcing SameSite cookie attributes and ensuring that all state-changing operations require explicit anti-CSRF tokens will disrupt the chaining mechanism required for this attack to succeed. Regular audits of file upload endpoints against CWE-434 and CWE-918 standards are recommended to prevent similar interpretation-based vulnerabilities in future updates or custom modules.