Which versions of Pandora Fms are affected by CVE-2026-30804?

Pandora FMS versions 777-800 contain a remote code execution vulnerability that allows authenticated administrators to upload and execute malicious files, creating a critical insider threat risk for…

How to fix or mitigate CVE-2026-30804?

Within 24 hours: Inventory all Pandora FMS deployments and identify instances running versions 777-800; document administrative user accounts and access logs for anomalies. Within 7 days: Restrict administrative access to Pandora FMS to only essential personnel, enforce MFA on admin accounts if supported, and disable file upload functionality if operationally feasible, or implement compensating controls (see below). Within 30 days: Upgrade to Pandora FMS version 801 or later (once confirmed patched by vendor), or migrate to an alternative monitoring solution if no patch timeline is provided by vendor.

Pandora Fms CVE-2026-30804

Q: What is the CVSS score of CVE-2026-30804?

CVE-2026-30804 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber. EPSS exploitation probability: 0.4%.

EUVD-2026-21986 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-13 PandoraFMS

RCE File Upload Pandora Fms

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Generated

Apr 13, 2026 - 16:42 vuln.today

CVSS changed

Apr 13, 2026 - 16:22 NVD

8.6 (HIGH)

EUVD ID Assigned

Apr 13, 2026 - 16:15 euvd

EUVD-2026-21986

Analysis Generated

Apr 13, 2026 - 16:15 vuln.today

CVE Published

Apr 13, 2026 - 15:44 nvd

HIGH 8.6

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability allows Remote Code Execution via file upload. This issue affects Pandora FMS: from 777 through 800

AnalysisAI

Remote code execution in Pandora FMS versions 777 through 800 enables authenticated administrators to upload malicious files and execute arbitrary code on the server. The vulnerability stems from inadequate file type validation during upload operations, allowing attackers with high-privilege credentials to bypass security controls. With a CVSS 4.0 score of 8.6 and attack complexity rated as low, this represents a significant risk for organizations using affected versions, though exploitation requires prior administrative access to the monitoring platform.

Technical ContextAI

This vulnerability is rooted in CWE-434 (Unrestricted Upload of File with Dangerous Type), a common weakness in web applications that fail to properly validate uploaded file types, extensions, or content. Pandora FMS, an open-source network and infrastructure monitoring solution, exposes file upload functionality to administrative users. The affected product (CPE: cpe:2.3:a:pandora_fms:pandora_fms) lacks sufficient server-side validation mechanisms to prevent the upload of executable files such as PHP scripts, web shells, or other dangerous file types. The CVSS vector indicates network-based exploitation with no attack complexity (AC:L, AT:N), meaning the vulnerability can be reliably triggered once administrative credentials are obtained. The scope is unchanged (S:N), but subsequent system impact extends beyond the vulnerable component with high confidentiality and integrity impacts (VC:H, VI:H) and low availability impact (VA:L). The authentication requirement (AU:Y) combined with high privileges required (PR:H) indicates this is a post-authentication vulnerability targeting the administrative interface.

RemediationAI

Organizations should immediately upgrade Pandora FMS to the latest patched version beyond build 800. While the provided data does not specify an exact patched release version, the vulnerability affects versions through 800, indicating that subsequent releases should contain the fix. Consult the official PandoraFMS security advisory (https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/) for the specific patched version and upgrade instructions. As an interim mitigation measure, restrict administrative access to Pandora FMS to trusted internal networks only, enforce strong multi-factor authentication for all administrative accounts, implement network segmentation to isolate the monitoring infrastructure, and review administrative account usage logs for suspicious file upload activity. Organizations unable to immediately patch should consider temporarily disabling file upload functionality if operationally feasible until the upgrade can be completed. Review all files uploaded by administrative users during the vulnerable period for potential web shells or malicious content.