CVE-2026-37066

Deferred Deferred - Pending Action

Path Traversal in Veno File Manager Project

Publication date: 2026-08-27

Last updated on: 2026-09-02

Assigner: MITRE

Description

Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests (POST and GET) to the affected endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-02

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-37066

Affected Vendors & Products

Vendor	Product	Version / Range
veno_file_manager_project	veno_file_manager	4.4.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-37066 is a path traversal vulnerability in Veno File Manager Project version 4.4.9. It allows an authenticated attacker with super administrator privileges to read arbitrary files on the server by sending specially crafted HTTP POST and GET requests to two vulnerable endpoints: /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php for unusual POST or GET parameters containing path traversal sequences like ../ or absolute file paths. Check server logs for requests with suspicious payloads targeting sensitive files such as /etc/passwd or configuration files.

Impact Analysis

An attacker could exploit this vulnerability to access sensitive files on the server, potentially leading to unauthorized data disclosure, system compromise, or further attacks if the exposed files contain credentials or configuration details.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA, which mandate strict protection of personal and health information. Exploitation may result in data breaches and non-compliance penalties.

Mitigation Strategies

Immediately update Veno File Manager Project to the latest version if available. If no patch exists, restrict access to the /vfm-admin/ directory to trusted IPs only. Disable the vulnerable endpoints if possible. Ensure super administrator accounts are limited to essential personnel and enforce strong authentication.

Hi! I’m here to help you understand CVE-2026-37066. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70