CVE-2026-64946: Pandora FMS CSRF and XSS Vulnerability

CVE-2026-64946 Overview

CVE-2026-64946 is a stored Cross-Site Scripting (XSS) vulnerability in the Pandora FMS File Manager module. The flaw chains a Cross-Site Request Forgery (CSRF) weakness with unrestricted Scalable Vector Graphics (SVG) file upload handling. Attackers can plant malicious SVG payloads that execute JavaScript in an administrator's browser context. Successful exploitation enables session cookie exfiltration and administrator account takeover. The issue affects Pandora FMS versions 777 and later and is tracked under CWE-79.

Critical Impact
Chained CSRF and SVG upload abuse yields stored XSS that can hijack administrator sessions and fully compromise the Pandora FMS management console.

Affected Products

Pandora FMS version 777
Pandora FMS versions after 777
File Manager module in affected Pandora FMS releases

Discovery Timeline

2026-10-01 - CVE CVE-2026-64946 published to NVD
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-64946

Vulnerability Analysis

The vulnerability combines two weaknesses in the Pandora FMS File Manager. First, the module lacks adequate anti-CSRF controls on upload actions. Second, it accepts SVG files without sanitizing embedded scripting constructs. An attacker who tricks an authenticated administrator into visiting a crafted page can submit a cross-origin upload request. The uploaded SVG is stored on the server and served with a content type that permits script execution. When any administrator later views or links to the file, the embedded JavaScript runs in the Pandora FMS origin.

Because the payload executes in the application origin, it can read session cookies that are not protected by HttpOnly, invoke administrative API endpoints, and persist additional backdoors. The result is stored XSS with the practical impact of administrator account takeover.

Root Cause

Two control gaps cause the issue. The File Manager upload endpoint does not validate an anti-CSRF token, so requests originating from arbitrary sites succeed when the victim holds a valid session. Separately, the upload handler does not restrict the SVG content, which can contain <script> elements or event-handler attributes that execute when the file is rendered.

Attack Vector

The attack requires network access to the Pandora FMS console and user interaction from an authenticated administrator. The attacker hosts a page that submits a forged multipart upload to the File Manager. The uploaded SVG is stored under an attacker-chosen name. Subsequent access to the file triggers JavaScript execution and session cookie theft. See the Pandora FMS Common Vulnerabilities advisory for vendor technical details.

No verified exploit code is published. The vulnerability mechanism is described in prose only.

Detection Methods for CVE-2026-64946

Indicators of Compromise

Newly created .svg files in the Pandora FMS File Manager storage directory that contain <script>, onload=, or javascript: strings.
Administrator session identifiers appearing in outbound HTTP requests to unexpected external hosts shortly after an SVG was accessed.
File Manager upload events originating from HTTP Referer headers outside the Pandora FMS console domain.

Detection Strategies

Scan uploaded SVG assets for embedded script tags, foreign event handlers, and external entity references.
Correlate File Manager write operations with the authenticated user's recent navigation to detect cross-origin upload patterns.
Alert on administrator sessions where cookies are transmitted to domains outside the Pandora FMS deployment.

Monitoring Recommendations

Log all File Manager upload actions with full request headers, including Origin and Referer.
Monitor web server access logs for GET requests to .svg files followed by anomalous administrative API calls from the same session.
Enable Content Security Policy (CSP) violation reporting to surface script execution from uploaded assets.

How to Mitigate CVE-2026-64946

Immediate Actions Required

Restrict access to the Pandora FMS console to trusted networks or VPN clients until a patched release is deployed.
Revoke and rotate administrator session cookies and credentials that may have been exposed.
Audit the File Manager storage directory and remove any SVG files containing scripting constructs.

Patch Information

Refer to the vendor advisory at Pandora FMS Common Vulnerabilities for fixed release information. Upgrade Pandora FMS to the version identified by the vendor as containing the fix for CVE-2026-64946.

Workarounds

Block .svg uploads at the File Manager layer or at a reverse proxy until the fix is applied.
Serve user-uploaded files from a separate, cookie-less origin and force the Content-Disposition: attachment header to prevent inline rendering.
Enforce a strict Content Security Policy that disallows inline scripts in the Pandora FMS console origin.
Require administrators to use isolated browser profiles when accessing the console to limit CSRF exposure.

bash

# Example reverse-proxy snippet to force SVG downloads instead of inline rendering
location ~* \.svg$ {
    add_header Content-Disposition "attachment";
    add_header X-Content-Type-Options "nosniff";
    types { application/octet-stream svg; }
}