Pandora FMS EUVD-2026-90596

Exploitation targets the Plugin File Manager component of Pandora FMS (versions 777 and later). The attack is a chain: the CSRF protection on the file-upload function must be bypassable, and the file-upload must accept executable PHP without restriction. The CVSS metrics UI:A and AT:P confirm that exploitation is NOT purely unauthenticated-remote: it requires an authenticated administrator to actively perform an interaction (the forged CSRF request being triggered from their authenticated session) plus a specific attack condition to hold. Limiting factors: the victim must be a logged-in Pandora FMS admin with file-manager access, must be socially engineered into triggering the malicious request, and the instance must expose the management interface to the attacker's lure path. No special non-default server configuration is documented beyond use of the Plugin File Manager feature.

This is a genuinely serious technical issue - a chained CSRF-bypass plus unrestricted file upload in Pandora FMS's Plugin File Manager yielding arbitrary PHP execution and full Remote Code Execution (CWE-434). The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H) scores 7.5 and reflects network reachability with high confidentiality, integrity and availability impact, but the score is pulled down from the ~9+ range by two qualifying metrics: AT:P (a specific attack requirement/condition must hold) and UI:A (active user interaction - the CSRF component requires an authenticated administrator to be lured into triggering the request). The exploitation-status signals are weak: no EPSS probability, no CISA KEV listing, and no public POC were provided, so under the precision rules this is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The result is a high-impact-but-conditionally-gated flaw: the RCE payoff is maximal, yet real-world exploitation hinges on tricking a logged-in admin (social-engineering a CSRF click) rather than a spray-and-pray unauthenticated hit. Treat as a high-priority patch for internet-exposed or multi-admin Pandora FMS installs, but note the single reference is only the vendor's generic CVE index page - affected-version detail ('from 777 onwards') and fix availability are not independently corroborated.

An attacker crafts a malicious web page that, when visited by an authenticated Pandora FMS administrator, silently issues a forged request that bypasses CSRF protection on the Plugin File Manager and uploads a PHP webshell. The attacker then requests the uploaded file directly, executing arbitrary PHP in the Pandora FMS context and gaining full server control. No public exploit code was identified at the time of analysis; success requires luring a logged-in admin into the trap (UI:A) and the specific attack condition (AT:P) being met.