CVE-2025-5306 is a critical OS command injection flaw (CVSS 9.8) in Pandora FMS, the monitoring platform from Artica. The Netflow directory field does not neutralise special elements, and the record lists builds 774 through 778 as affected. Check the vendor security notice for the fixed build and update.
What's affected
The record says improper neutralization of special elements in the Netflow directory field may allow OS command injection, and that the issue affects Pandora FMS 774 through 778. The weakness is CWE-77, command injection.
The record points to the vendor page that lists Pandora FMS security notices. I could not load that page while preparing this article, so I cannot name a fixed build. Check the vendor's list of common vulnerabilities and exposures for this CVE to find the build that contains the fix, and note whether the vendor describes any condition such as a required login.
Pandora FMS numbers its releases by build, which is why the record gives plain numbers such as 774 and 778.
How to check if you're exposed
Open the Pandora FMS console and read the version at the bottom of the page or in the About section. Compare the build with the range 774 through 778 in the record. If you are on a build in that range, treat the server as affected until the vendor notice says otherwise.
Then look at who can configure Netflow settings. A field that sets a directory path on the server is an administrative setting, so the first thing to check is which accounts have rights to change it, and whether the console is reachable from outside your management network.
Check the web server logs for changes to the Netflow settings that nobody on your team made.
What to do now
- Read your Pandora FMS build number and compare it with 774 through 778.
- Apply the update listed in the vendor security notice for this CVE, after a backup of the server and database.
- Restrict the console to a management network or VPN.
- Review the list of administrative accounts and remove or lock accounts that are not needed. Enforce strong passwords and multi factor authentication where supported.
- Review the Netflow settings and the host for changes you did not make.
Why it matters
Command injection means a setting that should only name a directory ends up inside a command that the server runs. Special characters in the value then change what the command does. In a monitoring platform the impact is amplified, because the server often holds credentials and network reach for many systems it watches.
The record gives no sign of use in attacks and the CVE is not on the CISA Known Exploited Vulnerabilities list. The Netflow field is likely an administrative control, which may lower the practical risk compared with an unauthenticated flaw, but the record does not say, so check the vendor notice. Monitoring servers are high value targets, so patch them promptly.
Quick check
Which build fixes it?
The record does not say. Check the Pandora FMS security notices page for the build that lists this CVE.
Sources
Last reviewed: 18 October 2026.
