CVE-2026-37073

Unknown

Published: 27/08/2026(UTC)Translated: 28/08/2026(UTC)NVD NIST

Summary

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMTP server on the application via making a POST request to the endpoint with needed parameters and header.

Risk Assessment

An attacker could abuse the SMTP server to send spam or phishing emails, potentially harming the organization's reputation and exposing users to attacks.

Recommendation

Update Veno File Manager to the latest patched version and restrict access to the sendfiles.php endpoint.

Original NVD description (English source)

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header.