Pandora FMS: Stored cross-site scripting in File Manager Create Directory
Summary
Missing input validation and output encoding of the directory name parameter in the File Manager's Create Directory function allow stored cross-site scripting in Pandora FMS from version 777 onwards. An attacker who can create directories can store malicious script code that runs in the browser of other users who view the affected page, which may lead to session hijacking or unauthorized actions in the console. The vendor and CVE record indicate fixes in 800.5, 805 and 800.6 LTS; the fix mapping to this CVE is not confirmed by the vendor.
Affected
- Pandora FMS from 777 onwards (according to the CVE record; default configuration listed as unaffected)
Fixed in
- Fixed in v800.5 and v805 (according to the CVE record)
- The 800.6 LTS patch notes list a fix for stored XSS in the dirname parameter of File Manager v2; the link to this CVE is inferred
- No confirmed fix for the 777.x LTS line
Workaround
- No vendor-documented workaround known.
- Restrict File Manager access to trusted administrators until the system is updated.
Exploitation
- No public proof of concept or known exploitation for this CVE found.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- Not listed in KEV. EPSS 0.00247.
Our recommendation
- Check whether your Pandora FMS installation is version 777.x or 800.x.
- Plan an upgrade to 800.6 LTS or later; confirm the upgrade path with the vendor, especially for 777.x.
- Restrict File Manager and administration access on internet-facing or shared consoles.
- Review the vendor advisory and NVD once the analysis is complete. The CVSS vector and privilege requirements are inconsistent and should be verified.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Pandora FMS Common Vulnerabilities and Exposures pandorafms.com
- Pandora FMS 800.6 LTS patch notes pandorafms.com
- Pandora FMS 805 feature release notes pandorafms.com
- OpenCVE: CVE-2026-64950 app.opencve.io
- VulnCheck/Vulnrichment: CVE-2026-64950 vulners.com
- Strix: CVE-2026-64950 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:58.
Original description (NVD)
Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.