CVE-2026-37070
UnknownSummary
Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint.
Risk Assessment
An attacker could gain access to sensitive files of other users, potentially leading to data leakage and privacy violations.
Recommendation
Update Veno File Manager to the latest patched version and implement proper file access authorization mechanisms.
Original NVD description (English source)
Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint.