CVE-2026-64947: Pandora FMS RCE Vulnerability

CVE-2026-64947 Overview

CVE-2026-64947 is a high-severity vulnerability in Pandora FMS affecting the Plugin File Manager component. The flaw chains a Cross-Site Request Forgery (CSRF) bypass with an unrestricted file upload weakness. An attacker who tricks an authenticated administrator into visiting a malicious page can upload and execute arbitrary PHP code. Successful exploitation yields Remote Code Execution (RCE) on the Pandora FMS server. The vulnerability maps to CWE-352: Cross-Site Request Forgery and affects Pandora FMS versions from 777 onwards.

Critical Impact

Attackers can achieve full Remote Code Execution on Pandora FMS servers by chaining CSRF with unrestricted PHP file upload, compromising confidentiality, integrity, and availability of the monitoring platform.

Affected Products

• Pandora FMS version 777
• Pandora FMS versions after 777
• Plugin File Manager component in Pandora FMS

Discovery Timeline

• 2026-10-01 - CVE-2026-64947 published to NVD
• 2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-64947

Vulnerability Analysis

The vulnerability resides in the Plugin File Manager feature of Pandora FMS. Two defects combine to produce Remote Code Execution. First, the file upload endpoint lacks a working anti-CSRF token validation. Second, the uploader does not restrict file extensions or validate file content. An attacker-controlled web page can forge a request that uploads a .php file through the authenticated victim's browser session. Once written to a web-accessible directory, the file executes under the privileges of the web server process. This grants the attacker arbitrary command execution on the host running Pandora FMS.

Root Cause

The root cause is twofold. The Plugin File Manager endpoint does not validate a CSRF token on state-changing POST requests. Separately, the upload handler accepts arbitrary file types without allowlisting extensions, MIME types, or performing content inspection. Chaining these defects allows cross-origin request forgery to deliver executable PHP payloads.

Attack Vector

Exploitation requires an authenticated administrator to interact with attacker-controlled content, typically through a phishing link or malicious website. The attacker's page issues a cross-origin request to the Plugin File Manager upload endpoint. Because the endpoint does not validate a CSRF token, the victim's browser forwards valid session cookies and the server accepts the request. The uploaded PHP file is then requested directly over HTTP, triggering code execution within the Pandora FMS application context.

No verified public proof-of-concept code is available. See the PandoraFMS Common Vulnerabilities Analysis for vendor-provided technical details.

Detection Methods for CVE-2026-64947

Indicators of Compromise

• Unexpected .php, .phtml, or .phar files in Pandora FMS plugin or upload directories.
• POST requests to the Plugin File Manager endpoint originating from external Referer headers.
• Web server access logs showing requests to newly created files in plugin directories shortly after an upload event.
• Outbound connections from the Pandora FMS server process to unknown IP addresses following suspicious upload activity.

Detection Strategies

• Monitor the Pandora FMS web root for new or modified executable script files using file integrity monitoring.
• Alert on HTTP POST requests to file manager endpoints that lack a valid Origin or Referer matching the Pandora FMS host.
• Correlate web server process spawning of shell interpreters such as /bin/sh, bash, or cmd.exe with recent file uploads.

Monitoring Recommendations

• Enable verbose web server access logging for the Pandora FMS console and retain logs centrally.
• Deploy endpoint telemetry on the Pandora FMS server to capture child process creation from httpd, nginx, or php-fpm.
• Review authentication logs for administrator sessions that coincide with unusual file manager activity.

How to Mitigate CVE-2026-64947

Immediate Actions Required

• Upgrade Pandora FMS to a fixed release once the vendor publishes patched builds; monitor the PandoraFMS security advisory page for updates.
• Restrict access to the Pandora FMS console to trusted management networks using firewall or reverse-proxy allowlists.
• Instruct administrators to log out of Pandora FMS sessions when not actively using the console to limit CSRF exposure.
• Audit the plugin and upload directories for unexpected PHP files and remove any unauthorized artifacts.

Patch Information

Refer to the PandoraFMS Common Vulnerabilities and Exposures page for the vendor's current remediation status and fixed version information. The vulnerability affects Pandora FMS version 777 and later.

Workarounds

• Disable the Plugin File Manager functionality for non-essential administrator accounts until a patch is applied.
• Enforce strict Content Security Policy and SameSite=Strict session cookies on the Pandora FMS console to reduce CSRF viability.
• Place the Pandora FMS console behind a web application firewall that blocks uploads of PHP file extensions.
• Require re-authentication or multi-factor confirmation for sensitive administrative actions where supported.

# Example nginx rule to block PHP uploads to the file manager endpoint
location ~ ^/pandora_console/.*file_manager.*\.php$ {
    if ($request_method = POST) {
        set $block "1";
    }
    if ($http_content_type ~* "multipart/form-data") {
        set $block "${block}1";
    }
    if ($block = "11") {
        return 403;
    }
}