CVE-2026-37071
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'rename' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming the application configuration file and triggering a rebuild of configuration and resetting super administrator credentials to default values.
Risk Assessment
Super administrator account takeover could lead to complete compromise of the application and data, potentially having severe consequences for the organization.
Recommendation
Update Veno File Manager to the latest patched version and restrict 'rename' permissions to trusted users only.
Other vulnerabilities in Veno File Manager
See all- CVE-2026-37072Critical
Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php.
- CVE-2026-37065Critical
Veno File Manager 4.4.9 is vulnerable to arbitrary file deletion in the translations endpoint. An attacker can delete any file in the application by using the 'remove' parameter in the request.
- CVE-2026-37073Medium
Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMTP server on the application via making a POST request to the endpoint with needed parameters and header.
- CVE-2026-37070Medium
Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint.
- CVE-2026-37069Medium
Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint.
- CVE-2026-37068High
The vulnerability allows arbitrary file write in Veno File Manager 4.4.9. An authenticated user with super administrator role can overwrite any PHP file in the application via a specially crafted POST request to the translations endpoint.
- CVE-2026-37067Medium
The access control vulnerability in Veno File Manager 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request to save-cvs.php.
- CVE-2026-37066Medium
The path traversal vulnerability in Veno File Manager 4.4.9 allows arbitrary file read. An authenticated attacker with super administrator role can disclose sensitive information via two specially crafted HTTP requests (POST and GET) to index.php and streamvid.php endpoints.
- CVE-2026-37064Medium
The user enumeration vulnerability in Veno File Manager 4.4.9 allows an unauthenticated attacker to check if a given user exists in the application. By sending a specially crafted POST request with a chosen 'user_name' parameter, the attacker can confirm account existence.
Original NVD description (English source)
Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming the application configuration file and triggering a rebuild of configuration and resetting super administrator credentials to default values.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS