CVE Catalog
CVE-2026-37067
UnknownSummary
The access control vulnerability in Veno File Manager 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request to save-cvs.php.
Risk Assessment
Unauthorized access to logs can expose sensitive information such as IP addresses, file paths, and potentially credentials, increasing the risk of further attacks.
Recommendation
Immediately restrict access to save-cvs.php and enforce authentication for all requests to the admin panel.
Original NVD description (English source)
Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request.