CVE-2026-30812: Artica Pandora FMS XSS Vulnerability

CVE-2026-30812 Overview

CVE-2026-30812 is a stored cross-site scripting (XSS) vulnerability in Pandora FMS, a monitoring solution developed by Artica. The flaw resides in the event comments feature, where user-supplied input is rendered into web pages without proper neutralization. An authenticated attacker can inject malicious script content into event comments, which then executes in the browser of any user who views the affected event.

The vulnerability is tracked under CWE-79 and affects Pandora FMS versions 777 through 800.

Critical Impact
Authenticated attackers can store JavaScript payloads in event comments that execute in other users' sessions, enabling session theft, UI manipulation, and pivoting against monitoring console users.

Affected Products

Artica Pandora FMS version 777
Artica Pandora FMS versions between 777 and 800
Artica Pandora FMS version 800

Discovery Timeline

2026-04-13 - CVE-2026-30812 published to NVD
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-30812

Vulnerability Analysis

The vulnerability stems from improper neutralization of input during web page generation within the event comments component of Pandora FMS. When a user submits a comment on a monitoring event, the application stores the input and later renders it back to the page without sufficient HTML encoding or sanitization.

Because the payload persists in the backend datastore, every user who views the affected event triggers execution of the injected script. This classifies the issue as stored XSS rather than reflected XSS, which increases the impact surface since no social engineering is required to deliver the payload.

Exploitation requires authenticated access with permission to comment on events, and the attacker must wait for another user to view the event. The confidentiality and integrity impacts are limited to data accessible within the browser session of the viewing user.

Root Cause

The root cause is missing output encoding when rendering the comment field of event records in the Pandora FMS web console. User-controlled content is concatenated into HTML output without contextual escaping, allowing <script> tags and event-handler attributes to be interpreted by the browser.

Attack Vector

An authenticated attacker with AW (event write) or equivalent permissions submits a comment containing an XSS payload to a Pandora FMS event. When an operator or administrator opens the event detail view, the stored payload executes in their authenticated session. The attacker can exfiltrate session cookies, perform actions on behalf of the victim, or modify the rendered console interface.

No verified proof-of-concept code is publicly available for this issue. Refer to the Pandora FMS Vulnerabilities Overview for vendor-provided technical context.

Detection Methods for CVE-2026-30812

Indicators of Compromise

Event comment records containing HTML tags such as <script>, <img onerror=>, or <svg onload=> stored in the Pandora FMS database.
Outbound HTTP requests from operator browsers to unexpected external hosts following event views.
Unusual session activity or privilege actions performed shortly after a user opens an event with comments.

Detection Strategies

Query the events table for comments matching regex patterns indicative of HTML or JavaScript content.
Inspect web server access logs for POST requests to the event comment endpoint containing encoded script payloads.
Review Content Security Policy (CSP) violation reports from browsers accessing the Pandora FMS console.

Monitoring Recommendations

Enable audit logging on event comment creation and modification within Pandora FMS.
Forward Pandora FMS application logs to a centralized SIEM for correlation with user session activity.
Alert on anomalous outbound connections originating from browsers of monitoring console operators.

How to Mitigate CVE-2026-30812

Immediate Actions Required

Upgrade Pandora FMS to a fixed release as published in the Pandora FMS CVE advisory page.
Restrict event comment permissions to the minimum set of users that require them.
Audit existing event comments and remove any entries containing HTML or script content.

Patch Information

Artica publishes fixed versions and remediation details through the Pandora FMS Vulnerabilities Overview. Administrators should consult the vendor advisory for the specific build that addresses CVE-2026-30812 and apply it to all Pandora FMS instances running versions 777 through 800.

Workarounds

Deploy a strict Content Security Policy that blocks inline scripts on the Pandora FMS console.
Place the Pandora FMS web interface behind a web application firewall (WAF) configured to block XSS payloads in event comment parameters.
Limit access to the monitoring console to trusted operators via network segmentation and VPN.

bash

# Example nginx CSP header to mitigate stored XSS execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;