CVE-2026-64949: Pandora FMS File Manager RCE Vulnerability

CVE-2026-64949 Overview

CVE-2026-64949 is an unrestricted file upload vulnerability in the Pandora FMS File Manager module. The flaw stems from an incomplete extension blacklist that fails to block .phar files. Authenticated users can upload and execute arbitrary PHP Archive (PHAR) files on the server, leading to code execution in the context of the web application. The issue affects Pandora FMS from version 777 onwards and is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated attackers can upload .phar files through the File Manager and achieve remote code execution on the Pandora FMS host, compromising monitoring data and potentially pivoting into monitored infrastructure.

Affected Products

Pandora FMS version 777
Pandora FMS versions subsequent to 777 (prior to vendor fix)
Pandora FMS File Manager module

Discovery Timeline

2026-10-01 - CVE-2026-64949 published to the National Vulnerability Database
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-64949

Vulnerability Analysis

The Pandora FMS File Manager module validates uploaded files against a denylist of forbidden extensions. The denylist omits the .phar extension, which the Apache HTTP Server and PHP interpreter treat as executable PHP by default. An authenticated user with access to the File Manager can upload a crafted .phar archive to a web-accessible directory. Requesting the file through the web server triggers PHP execution, running arbitrary attacker-controlled code with the privileges of the web service account.

Pandora FMS is a widely deployed network and infrastructure monitoring platform, so a compromised instance exposes credentials, SNMP strings, API tokens, and remote agent configurations. The CVSS 4.0 score of 8.6 reflects the network attack vector combined with the high integrity, confidentiality, and availability impact on the vulnerable system.

Root Cause

The root cause is reliance on an incomplete extension blacklist rather than an allowlist of safe file types. Blacklist-based input filtering fails to anticipate every server-executable extension. On a standard LAMP stack, PHP interprets .phar, .phtml, and .php files, but the File Manager only blocks a subset. This design pattern is the canonical scenario described by CWE-434.

Attack Vector

Exploitation requires valid authenticated credentials with permission to use the File Manager module. The attacker crafts a .phar payload embedding PHP code, uploads it through the File Manager interface, and then issues an HTTP request to the uploaded resource. The web server routes the request to the PHP handler, which executes the attacker code. No user interaction beyond the initial upload is required. Further technical context is available in the Pandora FMS Vulnerabilities Overview.

Detection Methods for CVE-2026-64949

Indicators of Compromise

Presence of .phar files within Pandora FMS web-accessible directories, particularly File Manager upload paths
HTTP POST requests to the File Manager endpoint containing multipart uploads with .phar filenames
Unexpected outbound network connections or reverse shells originating from the Pandora FMS web server process
New or modified PHP processes spawning shell interpreters such as /bin/sh, bash, or nc

Detection Strategies

Hunt web server access logs for GET requests to .phar URIs under Pandora FMS content paths
Review File Manager audit logs for upload actions by non-administrative accounts
Correlate web request telemetry with child process creation events on the Pandora FMS host
Alert on PHP-FPM or Apache workers executing shell commands, package managers, or network utilities

Monitoring Recommendations

Enable file integrity monitoring on Pandora FMS document roots and upload directories
Forward Apache, Nginx, and PHP error logs to a central SIEM for correlation
Monitor authentication logs for unusual Pandora FMS console logins preceding File Manager activity
Baseline normal File Manager usage patterns and alert on deviations such as off-hours uploads

How to Mitigate CVE-2026-64949

Immediate Actions Required

Apply the Pandora FMS vendor patch referenced on the Pandora FMS security advisory page as soon as it is available
Restrict File Manager access to a minimal set of trusted administrative accounts and enforce strong authentication
Audit Pandora FMS web directories for existing .phar files and remove any that are not legitimate
Rotate credentials, API tokens, and SNMP strings stored in Pandora FMS if compromise is suspected

Patch Information

Pandora FMS tracks fixes for reported vulnerabilities on its Common Vulnerabilities and Exposures page. Administrators should apply the version released after Pandora FMS 777 that explicitly addresses the File Manager extension filter. Validate the patched version in a staging environment before production rollout.

Workarounds

Configure the web server to deny execution of .phar files in Pandora FMS upload directories using an Apache <FilesMatch> or Nginx location block
Place the Pandora FMS console behind a VPN or reverse proxy that enforces multi-factor authentication
Remove or disable the File Manager module for accounts that do not require it
Deploy a Web Application Firewall rule that blocks multipart uploads containing .phar filenames

bash

# Apache: block execution of .phar files in Pandora FMS web root
<Directory "/var/www/html/pandora_console/images">
    <FilesMatch "\.(phar|phtml|php3|php4|php5|php7)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent
location ~* \.(phar|phtml)$ {
    deny all;
    return 403;
}