CVE-2026-64947 CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager
Attackers can bypass CSRF protections to upload and execute arbitrary PHP code, leading to remote code execution on Pandora FMS instances.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-64947?
CVE-2026-64947 is a high-severity vulnerability in Pandora FMS, published on 1 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards.
Which versions are affected by CVE-2026-64947?
How do I fix CVE-2026-64947?
No fix has been published for CVE-2026-64947 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-64947 being exploited?
There is no known exploitation of CVE-2026-64947 in the wild and no public exploit code.
Sources
Also known as GHSA-cqqp-fqm5-2w6f.