CVE-2026-64950

Stored Cross-Site Scripting via Directory Name in File Manager Create Directory PUBLISHED

Description (CNA)

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards.

Affected (CNA)

Vendor / product	Versions
Pandora FMS / Pandora FMS	affected 777

CWE

CWE-79

References

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.