CVE-2026-64950

The vulnerability arises from inadequate input validation and output encoding in the directory name parameter of the File Manager's Create Directory feature in Pandora FMS versions 777 and later. This flaw enables stored cross-site scripting (XSS) attacks, allowing malicious scripts to execute without user interaction, potentially compromising user data and system integrity. Organizations using affected versions of Pandora FMS should prioritize remediation to mitigate the risk of exploitation.