Arbitrary File Deletion in Veno File Manager

Executive Summary

CVE-2026-37065 is an Arbitrary File Deletion vulnerability in Veno File Manager Project version 4.4.9. An authenticated attacker with superadmin privileges can exploit it by sending a crafted POST request to a vulnerable endpoint using the 'remove' parameter in the 'url' field. This allows deletion of any file on the system without further user interaction.

Useful 0 Not Useful 0

Detection Guidance

Check for unusual file deletions or modifications in the Veno File Manager directory. Monitor POST requests to /vfm-admin/index.php with the 'remove' parameter in the 'url' field. Look for superadmin accounts making unexpected requests.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to delete critical files on the system, potentially causing the application to become non-functional. For example, deleting root index.php could render the application unusable.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated attacker with superadmin privileges to delete arbitrary files on the system. If critical files are deleted, the application may become non-functional, potentially leading to data loss or service disruption. This could impact compliance with standards like GDPR (data protection) or HIPAA (healthcare data) by compromising data integrity or availability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Veno File Manager to a patched version. Restrict superadmin privileges to only necessary users. Implement file integrity monitoring to detect unauthorized deletions. Block suspicious POST requests to the vulnerable endpoint.

Useful 0 Not Useful 0