CVE-2026-37065

Unknown

Published: 27/08/2026(UTC)Translated: 28/08/2026(UTC)NVD NIST

Summary

Veno File Manager 4.4.9 is vulnerable to arbitrary file deletion in the translations endpoint. An attacker can delete any file in the application by using the 'remove' parameter in the request.

Risk Assessment

Arbitrary file deletion can lead to data loss, application corruption, or complete service unavailability.

Recommendation

Immediately update Veno File Manager and restrict access to the translations functionality to trusted administrators only.

Original NVD description (English source)

Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=.