CVE-2026-37068

Unknown

Published: 27/08/2026(UTC)Translated: 28/08/2026(UTC)NVD NIST

Summary

The vulnerability allows arbitrary file write in Veno File Manager 4.4.9. An authenticated user with super administrator role can overwrite any PHP file in the application via a specially crafted POST request to the translations endpoint.

Risk Assessment

An attacker with super administrator privileges can inject malicious PHP code, potentially leading to full server compromise and application integrity violation.

Recommendation

Immediately update Veno File Manager to the latest version and restrict access to the admin panel to trusted users only.

Original NVD description (English source)

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint.