CVE-2026-37069
UnknownSummary
Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint.
Risk Assessment
Absolute path disclosure could help an attacker in further attacks, such as exploring the file system or exploiting other vulnerabilities.
Recommendation
Update Veno File Manager to the latest patched version and remove or secure the RelativePath.Example1.php file.
Original NVD description (English source)
Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint.