CVE-2026-37066: Path Traversal
Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests (POST and GET) to the affected endpoints.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated account with the super administrator role. It is therefore primarily relevant where super administrator credentials are compromised or overly broadly assigned.
Which requests and endpoints are involved?
The issue is triggered through specially crafted HTTP requests to /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php. The described attack uses POST and GET requests to these affected endpoints.
What is the impact of successful exploitation?
A successful path traversal attack can result in arbitrary file read, allowing the super administrator attacker to disclose sensitive information accessible to the application.