Pandora FMS: Unrestricted file upload leading to code execution in File Manager
Summary
Pandora FMS from version 777 onwards uses an incomplete blacklist of file extensions in its File Manager module. An authenticated user with high privileges can upload and run .phar files, which allows arbitrary code execution on the server. The CVSS 4.0 score is 8.6 (High), and CISA SSVC rates the issue as not automatable.
Affected
- Pandora FMS from version 777 onwards, according to the CVE record.
- Exact affected 777.x builds: Unknown.
Fixed in
- Fixed in v800.5 and v805, according to the CVE record.
- The vendor advisory could not be verified, so it is Unknown whether 777.x LTS builds are fixed.
Workaround
- No vendor workaround known.
- Generic measures for similar flaws: restrict access to the File Manager and console to management networks or VPN, use least privilege for service accounts, monitor logs for suspicious uploads, and consider WAF rules for file uploads.
Exploitation
- Not listed as known exploited (CISA KEV: No).
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No public proof of concept found.
Our recommendation
- Identify all Pandora FMS instances from 777 onwards and their exact builds.
- Update to v800.5 or v805, or the latest fixed release, and confirm against the vendor advisory.
- Restrict console access to management networks or VPN and review admin accounts and passwords.
- Check File Manager upload directories for unexpected .phar or script files.
- Check CVE-2026-64947 as well when patching.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record source: Pandora FMS security page pandorafms.com
- strix.ai: CVE-2026-64949 www.strix.ai
- vulners.com: VULNRICHMENT CVE-2026-64949 vulners.com
- Pandora FMS patch notes 777.19 LTS pandorafms.com
- strix.ai: CVE-2026-64947 (related issue) www.strix.ai
- Armis: CVE-2023-24517 (similar File Manager upload flaw) cve.armis.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:33.
Original description (NVD)
Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.