CVE-2026-37071

Unknown

Published: 27/08/2026(UTC)Translated: 28/08/2026(UTC)NVD NIST

Summary

Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'rename' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming the application configuration file and triggering a rebuild of configuration and resetting super administrator credentials to default values.

Risk Assessment

Super administrator account takeover could lead to complete compromise of the application and data, potentially having severe consequences for the organization.

Recommendation

Update Veno File Manager to the latest patched version and restrict 'rename' permissions to trusted users only.

Original NVD description (English source)

Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming the application configuration file and triggering a rebuild of configuration and resetting super administrator credentials to default values.