CVE-2026-64950 in Pandora FMS
Summary
by MITRE • 10/01/2026
Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified involves a critical lack of input validation and insufficient output encoding within the directory naming functionality of the File Manager component in Pandora FMS versions starting from build 777. This security flaw permits attackers to inject malicious script content directly into the system by exploiting how user-supplied data is processed during the creation of new directories. Unlike cross-site scripting attacks that require a victim to click on a crafted link or interact with specific interface elements, this vulnerability allows for stored execution of arbitrary JavaScript code without any subsequent user interaction beyond the initial injection point being accessed by an authenticated administrator or user with file management privileges. The core technical issue stems from the application's failure to sanitize special characters and script tags within the directory name parameter before storing it in the backend database, as well as its failure to encode this data when rendering it back into HTML contexts for display in the web interface.
From a technical perspective, the flaw represents a classic instance of stored cross-site scripting where untrusted input is treated as executable code rather than plain text. When an attacker submits a directory name containing embedded JavaScript payloads such as script tags or event handlers like onerror or onload attributes, the application accepts this input without applying necessary security filters. Subsequently, when any user views the file list or navigates to that specific directory within the File Manager interface, the browser parses and executes the malicious scripts because they are rendered directly into the page structure without proper HTML entity encoding. This mechanism bypasses same-origin policy protections if the injected script can access cookies, session tokens, or other sensitive data associated with the user's current session, effectively allowing the attacker to hijack active sessions or perform actions on behalf of the victim within the context of the trusted Pandora FMS application domain.
The operational impact of this vulnerability is severe due to its potential for widespread compromise and persistence. Because the malicious payload is stored in the database associated with a specific directory name, every time that directory listing is displayed, the attack triggers automatically. This means that any administrator or user who accesses the File Manager module could inadvertently execute the attacker's code, leading to unauthorized access to sensitive network monitoring data, configuration files, and system credentials managed by Pandora FMS. Furthermore, since no additional interaction is required after the initial injection, the window of opportunity for exploitation is significantly widened compared to reflected XSS attacks which depend on social engineering or specific URL manipulation. The persistence of the payload ensures that the threat remains active until the malicious directory is manually deleted, creating a long-term risk vector within the organization's security posture.
In terms of industry standard classifications, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and more specifically falls under Stored XSS variants where data is persisted in non-volatile storage before being retrieved by users. It also relates to CWE-20 Improper Input Validation regarding the failure to check directory names for dangerous characters or patterns. From an offensive security framework perspective, this attack vector maps directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter particularly JavaScript execution within a browser environment, and potentially T1078 Valid Accounts if used in conjunction with compromised credentials to facilitate the initial injection. The lack of output encoding further highlights deficiencies in secure coding practices related to data handling and presentation layers.
To mitigate this vulnerability, immediate remediation efforts should focus on implementing robust input validation and strict output encoding mechanisms within the File Manager module. Input validation must enforce a whitelist approach for directory names, allowing only alphanumeric characters, hyphens, underscores, and periods while rejecting any special symbols that could be interpreted as HTML or JavaScript syntax such as angle brackets, quotes, ampersands, and parentheses. Simultaneously, output encoding should be applied consistently whenever user-supplied data is rendered in an HTML context to ensure that all reserved characters are converted into their corresponding HTML entities preventing the browser from interpreting them as executable code. Developers must also consider implementing Content Security Policy headers to restrict script execution sources and add additional layers of defense against potential exploitation even if input validation fails. Upgrading to a patched version of Pandora FMS where these security controls have been properly implemented is the most effective long-term solution for organizations relying on this platform for network monitoring operations.