Pandora FMS CVE-2026-64950

Requires an authenticated account with privileges to access Pandora FMS's File Manager and use its Create Directory function (CVSS PR:H) - this is not an unauthenticated remote attack. The attacker must be able to reach the File Manager, which is an administrative/privileged area, and a victim must subsequently view the directory listing containing the stored payload (the description states it then executes without further interaction, i.e., on page render). Exploitation is limited to Pandora FMS installations at version 777 or later; the privileged-access requirement is the primary limiting factor reducing real-world risk.

This is a stored (persistent) cross-site scripting flaw (CWE-79) in Pandora FMS's File Manager 'Create Directory' function, where the directory-name parameter is neither input-validated nor output-encoded. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N) scores 8.4 and is notably aggressive: it rates confidentiality and integrity impact as High (VC:H/VI:H), which overstates a typical browser-context XSS whose impact is usually limited to the compromised session rather than full system CIA. Critically, exploitation requires PR:H - the attacker must already hold a privileged account with access to the File Manager Create Directory feature - which sharply limits who can plant the payload and makes this far less severe in practice than the 8.4 base score suggests. There is a conflict within the input: the vector uses UI:P (passive user interaction) while the description states the payload executes 'without user interaction,' meaning the script fires automatically when a victim views the affected directory listing rather than requiring an extra click - verify victim-interaction assumptions against vendor guidance. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so this is best treated as a moderate-priority, authentication-gated issue rather than an urgent widely-exploited threat; the real risk is a privileged insider or a hijacked admin account escalating to session compromise of other operators viewing the file manager.

An authenticated, privileged Pandora FMS user with access to the File Manager navigates to Create Directory and supplies a directory name containing a malicious script payload instead of a valid name. The payload is stored and later rendered unescaped when any user (typically another administrator/operator) views that directory listing, executing JavaScript automatically in their browser session. No public proof-of-concept or exploit code is identified in the provided data.