CVE-2026-37068: Veno Veno File Manager Project vulnerability
Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated account with the super administrator role. Users without that role are not identified as able to exploit the affected endpoint.
What access does an attacker need to overwrite files?
The attacker must be able to send a specially crafted POST request to /vfm-admin/index.php with section=translations and action=update. Successful exploitation can overwrite PHP files within the application.
How can I identify potential exposure?
Review deployments of Veno File Manager Project 4.4.9 and audit super administrator activity and POST requests to the translations update endpoint. Investigate unexpected changes to PHP files in the application.