CVE-2026-64949

Description

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards.

References

• https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/