The vulnerability is an Unrestricted File Upload that allows the upload of files with dangerous types, resulting in the ability for an attacker to execute arbitrary code on the affected system. It is classified as a type of input validation weakness. The flaw could let a malicious user upload a script or application binary that the system later executes, giving full control over the impacted server.

Pandora FMS is vulnerable in all releases from 777 up through 800. These include the core monitoring and management components distributed under the Pandora FMS brand.

The CVSS score of 8.6 reflects high severity with a high likelihood of exploitation if an attacker can reach the upload interface. The EPSS score is unavailable, but the vulnerability is not listed in the CISA KEV catalog. Because the flaw involves unrestricted file upload through a web interface, the likely attack vector is via a web-based upload endpoint that accepts arbitrary files without proper type validation.