CVE-2026-64947

{
  "etk_id": "ETK-2026-239",
  "cve_id": "CVE-2026-64947",
  "display_id": "CVE-2026-64947",
  "ghsa_id": "GHSA-cqqp-fqm5-2w6f",
  "euvd_id": "EUVD-2026-90596",
  "status": "published",
  "anchor_state": "anchored",
  "title": "CSRF bypass and unrestricted upload in Pandora FMS Plugin File Manager",
  "summary": "Pandora FMS releases from 777 onward are affected in the Plugin File Manager. An attacker who can combine the CSRF-bypass and unrestricted-upload flaws may trigger execution of PHP code; the advisory does not specify further access prerequisites.",
  "mitigation": "Disable the Plugin File Manager where it is not needed, or restrict its access to trusted administrators and reduce its network exposure. Monitor for vendor remediation because no fixed version is recorded.",
  "vendor": "Pandora FMS",
  "product": "Pandora FMS",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "777"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Pandora FMS",
      "purl": null
    }
  ],
  "cwes": [
    434
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:N/AU:Y/R:I/V:C/RE:H/U:Red",
  "epss_score": 0.0025,
  "epss_percentile": 0.1543,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 41.64123481666667,
  "t0_at": "2026-10-01T09:27:46.696000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-01T09:27:46.696000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T09:27:46.696000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64947"
    }
  }
}