CVE-2026-37068

Deferred Deferred - Pending Action

Arbitrary File Write in Veno File Manager 4.4.9

Publication date: 2026-08-27

Last updated on: 2026-09-02

Assigner: MITRE

Description

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-02

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-37068

Affected Vendors & Products

Vendor	Product	Version / Range
veno_file_manager_project	veno_file_manager_project	4.4.9
veno_file_manager_project	veno_file_manager	4.4.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is an arbitrary file write issue in Veno File Manager Project version 4.4.9. An authenticated user with super administrator privileges can send a specially crafted POST request to the endpoint /vfm-admin/index.php?section=translations&action=update to overwrite any PHP file in the application.

Detection Guidance

Check for unauthorized modifications to PHP files in the Veno File Manager directory. Look for suspicious POST requests to /vfm-admin/index.php?section=translations&action=update with file write payloads. Monitor logs for super administrator actions during unusual times.

Impact Analysis

If exploited, this vulnerability could allow an attacker to replace critical PHP files with malicious code, leading to complete system compromise. This could result in unauthorized access, data theft, or further attacks on the system.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR, HIPAA, and other regulations. Organizations could face legal penalties, reputational damage, and loss of trust due to compromised data.

Mitigation Strategies

Immediately restrict super administrator access to only trusted users. Update Veno File Manager to a patched version if available. Review and audit all PHP files for unauthorized changes. Implement file integrity monitoring for critical directories.

Hi! I’m here to help you understand CVE-2026-37068. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70