CVE-2026-64950

Missing input validation and output encoding on the directory name parameter in File Manager's…

Risk score: 53/100
CVSS: 8.4 v4.0
Exploit chance (30 days): 0.2%
Published: 1 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards.
Affected: See advisory
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Why it is Yellow

CVSS 8.4 high

References

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/

Original description

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards.

Last activity 1 Oct 2026. Patch Forecast updates every hour.