CVE-2026-64949 — Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager
Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards.
Published: 2026-10-01 · CVSS: 8.6 · CVSS 4.0
Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7