CVE-2026-64946 — CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager

CVE-2026-64946

CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager PUBLISHED

Description (CNA)

A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards.

Affected (CNA)

Vendor / product	Versions
Pandora FMS / Pandora FMS	affected 777

CWE

CWE-79, CWE-352

References

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.