Pandora FMS CVE-2026-64946

Exploitation requires the target to run Pandora FMS version 777 or later with the File Manager module accessible, and requires a victim who is an authenticated administrator to be lured into triggering the attacker's CSRF request (UI:A / AT:P). The File Manager's acceptance of SVG files without content restriction is the core enabling condition - SVGs can carry embedded JavaScript that executes when rendered. Limiting factors: the attack is not a direct unauthenticated server compromise; it depends on social-engineering an active admin session (CSRF has no anti-CSRF protection on the upload), the uploaded SVG being subsequently rendered in a browser context, and the admin's session cookie being accessible to script (no HttpOnly protection on the relevant cookie).

This is a multi-stage client-side attack chain (CSRF → unrestricted SVG upload → stored XSS → cookie theft → admin takeover) in Pandora FMS, scored 7.4 (High) under CVSS 4.0 by the vendor. The vendor's 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N) indicates a network-reachable, unauthenticated attacker but requires an attack 'requirement' (AT:P - e.g. the CSRF must land on a logged-in session) and ACTIVE user interaction (UI:A), meaning a victim administrator must be induced to act. There is NO EPSS score, NO CISA KEV listing, and NO public exploit referenced in the provided data, so exploitation status is: no public exploit identified at time of analysis. The high CVSS is driven by the full-confidentiality/full-integrity impact of administrator account takeover, but real-world exploitability is gated by the chained preconditions (victim must be an authenticated admin who is socially engineered into the CSRF flow), which lowers practical risk below what the 7.4 suggests. Only one reference is provided - the vendor's generic security advisory index page - so affected-version precision, patch availability, and any POC status cannot be independently confirmed. Treat as a credible vendor-reported issue warranting patching on exposed/internet-facing instances, but not an emergency absent evidence of active exploitation.

An attacker crafts a malicious page that, when visited by a logged-in Pandora FMS administrator, silently issues a CSRF request to the File Manager module uploading a weaponized SVG containing embedded JavaScript. When the SVG is later rendered in the console, the stored XSS executes in the admin's browser, exfiltrating the session cookie to the attacker, who then hijacks the administrator session. No public exploit is referenced, and the chain requires the victim admin to be authenticated and to trigger the attacker-controlled interaction (UI:A).