CVE-2026-37064: Veno File Manager vulnerability
User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated attacker who can send POST requests to the affected Veno File Manager endpoint can attempt to enumerate user accounts.
What information does an attacker need to begin enumeration?
The attacker only needs to supply chosen values for the user_name parameter in specially crafted POST requests to /vfm-admin/ajax/usr-check.php. No valid account or authentication is required.
How can I determine whether the issue is exposed in my deployment?
Check whether Veno File Manager Project 4.4.9 is deployed and whether /vfm-admin/ajax/usr-check.php is reachable by unauthenticated users. An exposed endpoint that returns distinguishable results for existing versus nonexistent user_name values permits enumeration.