Path Traversal leading to Local File Inclusion

published 2023-01-27 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-46947

cvss: 5.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 58%
public exploits: 0; none known

There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is called to check that the parameter that the user has inserted does not contain malicious characteres, but this check is insufficient. An attacker could insert an absolute path to overcome the heck, thus being able to incluse any PHP file that resides on the disk. The exploitation of this vulnerability could lead to a remote code execution.

Patch / fix

fixed in 1

pandorafms pandora_fms 766

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 19 mo ago (2025-03-27)

Exploit prediction

0.85% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.9	CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Artica PFMS Pandora FMS

Classification

Weakness

CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

pandorafms.com /en/security/common-vulnerabilities-and-exposures/
vendor-advisory

Sources

CVE List CVE-2022-43979
NVD CVE-2022-43979

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary