CVE-2026-37071: Veno Veno File Manager vulnerability
Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming the application configuration file and triggering a rebuild of configuration and resetting super administrator credentials to default values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Veno File Manager Projectto a version that resolves this vulnerability.Fixed in 4.4.9 - Compensating control
Restrict access to the endpoint used for file renaming (the affected endpoint in the Actions::renameFile() flow) so only trusted administrators can reach it, reducing the ability of authenticated attackers with 'reanme' permission to perform crafted POST requests.
- Operational
Assume the super administrator account credentials were reset to default values due to the attack; verify and reset the super administrator password/credentials to new secure values after remediation.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have the 'reanme' permission. The issue is therefore relevant to deployments where accounts with that permission are not fully trusted.
What does exploitation require?
The attacker sends a specially crafted POST request to the affected rename endpoint. The attack renames the application configuration file, triggers configuration rebuilding, and resets the super administrator credentials to their default values.
How can defenders identify a possible compromise?
Investigate unexpected renaming of the application configuration file and any configuration rebuild events. A reset of super administrator credentials to default values should be treated as a potential indicator of exploitation.