CVE-2026-64950: Pandora FMS File Manager XSS Vulnerability

CVE-2026-64950 Overview

CVE-2026-64950 is a stored cross-site scripting [CWE-79] vulnerability in Pandora FMS File Manager. The flaw stems from missing input validation and output encoding on the directory name parameter in the Create Directory function. An authenticated attacker can inject a malicious payload that executes in another user's browser without interaction when the stored directory listing is rendered. The vulnerability affects Pandora FMS version 777 and later.

Critical Impact
Stored XSS executes in administrator browsers without user interaction, enabling session theft, administrative action abuse, and compromise of monitored infrastructure managed through Pandora FMS.

Affected Products

Pandora FMS version 777
Pandora FMS versions later than 777
Pandora FMS File Manager component

Discovery Timeline

2026-10-01 - CVE CVE-2026-64950 published to NVD
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-64950

Vulnerability Analysis

The vulnerability resides in the Pandora FMS File Manager module, specifically the Create Directory workflow. When a user submits a new directory name, the application stores the value without sanitizing script-bearing characters. The directory name is later rendered back to the File Manager interface without proper output encoding. Any script payload embedded in the name executes in the context of users viewing the file listing.

Because the payload persists server-side, the attack qualifies as stored XSS. Execution occurs when a victim navigates to the File Manager, requiring no additional user interaction beyond normal application use. Attackers can leverage the executed script to steal session cookies, perform cross-site requests as the victim, modify monitoring configurations, or pivot into managed network devices.

Root Cause

The root cause is twofold. First, the application fails to validate or sanitize the directory name parameter during the create operation. Second, the rendering layer emits the stored value without HTML entity encoding. Either control, correctly implemented, would mitigate the issue. The absence of both allows arbitrary HTML and JavaScript to persist and execute.

Attack Vector

Exploitation requires network access to the Pandora FMS console and authenticated privileges sufficient to use File Manager. The attacker creates a directory containing a crafted payload in the name field. The payload stays dormant until another user, typically an administrator, loads the File Manager view. The script then executes under the victim's session, inheriting their effective permissions within the application.

No verified public proof-of-concept code is available at this time. Refer to the Pandora FMS CVE Overview for vendor-published technical details.

Detection Methods for CVE-2026-64950

Indicators of Compromise

Directory names in Pandora FMS File Manager containing HTML tags such as <script>, <img, <svg, or onerror= handlers.
Unexpected outbound requests from administrator browsers to attacker-controlled domains after visiting the File Manager view.
Audit log entries showing directory creation events with abnormally long or non-alphanumeric names.

Detection Strategies

Review Pandora FMS audit logs for Create Directory actions and inspect submitted directory names for HTML or JavaScript characters.
Query the underlying filesystem or database for directory entries containing angle brackets, quotes, or event handler syntax.
Deploy web application firewall rules that flag POST requests to the File Manager endpoint containing script-like payloads in the directory name parameter.

Monitoring Recommendations

Enable verbose audit logging within Pandora FMS and forward events to a centralized log platform for correlation.
Monitor administrator sessions for anomalous API calls originating immediately after File Manager page loads.
Alert on new or unusual outbound HTTP connections from workstations used to access the Pandora FMS console.

How to Mitigate CVE-2026-64950

Immediate Actions Required

Restrict File Manager access to the minimum set of trusted administrators until a patched release is deployed.
Audit existing directory names in File Manager and remove any entries containing HTML or JavaScript characters.
Rotate session cookies and credentials for any accounts that may have viewed poisoned File Manager content.

Patch Information

Consult the Pandora FMS CVE Overview for the vendor's current fixed version information and apply the recommended update to Pandora FMS version 777 and later installations.

Workarounds

Enforce a Content Security Policy (CSP) on the Pandora FMS console to limit inline script execution.
Place the Pandora FMS console behind a web application firewall with rules blocking script syntax in directory name parameters.
Limit File Manager role permissions so only vetted administrators can create directories.

bash

# Example web application firewall rule concept
# Block directory name parameters containing script-related characters
SecRule ARGS:directory_name "@rx (<|>|script|onerror|onload|javascript:)" \
    "id:1026649500,phase:2,deny,status:403,msg:'Potential XSS in Pandora FMS File Manager directory name'"