CVE-2026-37070: Veno File Manager vulnerability
Published Aug 27, 2026
·Updated
Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint.
Affected Software
1 affected component
Veno File Manager=4.4.9
Event History
Aug 27, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:17 PM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An attacker must be authenticated to Veno File Manager. They also need to know the path and filename of a file uploaded by another user.
2
What data can be exposed?
The affected endpoint can allow an authenticated user to read uploaded files belonging to other users. The disclosure is limited by the paths and filenames the attacker knows.
3
How can I determine whether my deployment is affected?
Check whether the deployment uses Veno File Manager version 4.4.9 and exposes the /vfm-admin/ajax/streamvid.php endpoint to authenticated users.