Path Traversal in Veno File Manager Project

Executive Summary

CVE-2026-37066 is a path traversal vulnerability in Veno File Manager Project version 4.4.9. It allows an authenticated attacker with super administrator privileges to read arbitrary files on the server by sending specially crafted HTTP POST and GET requests to two vulnerable endpoints: /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP requests to /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php for unusual POST or GET parameters containing path traversal sequences like ../ or absolute file paths. Check server logs for requests with suspicious payloads targeting sensitive files such as /etc/passwd or configuration files.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this vulnerability to access sensitive files on the server, potentially leading to unauthorized data disclosure, system compromise, or further attacks if the exposed files contain credentials or configuration details.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA, which mandate strict protection of personal and health information. Exploitation may result in data breaches and non-compliance penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Veno File Manager Project to the latest version if available. If no patch exists, restrict access to the /vfm-admin/ directory to trusted IPs only. Disable the vulnerable endpoints if possible. Ensure super administrator accounts are limited to essential personnel and enforce strong authentication.

Useful 0 Not Useful 0