CVE-2021-36697

6.7 mediumEPSS 0.3%

With an admin account, the .htaccess file in Artica Pandora FMS <=755 can be overwritten with the File Manager component. The new .htaccess file contains a Rewrite Rule with a type definition. A normal PHP file can be uploaded with this new "file type" and the code can be executed with an HTTP request.

Severity

CVSS 3.1

6.7 medium

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE: CWE-74
Published: 2021-11-03
Modified: 2026-07-09
Record from: the NVD, synced 2026-10-19

Affected

artica:pandora_fms

References

https://k4m1ll0.com/chained_exploit_htaccess.html
https://k4m1ll0.com/chained_exploit_htaccess.html

Check your stack JSON