Incorrect Access Control in Veno File Manager Allows Unauthorized File Access

Executive Summary

This vulnerability is an incorrect access control issue in the Veno File Manager Project version 4.4.9. It allows an authenticated attacker to read any uploaded files by other users if they know the file path and name. The attacker can exploit this by sending a specially crafted GET request to the affected endpoint /vfm-admin/ajax/streamvid.php.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if Veno File Manager 4.4.9 is installed and verify if the affected endpoint /vfm-admin/ajax/streamvid.php is accessible. Look for unauthorized file access attempts or unusual GET requests to this path. Review server logs for suspicious activity targeting this endpoint.

Useful 0 Not Useful 0

Impact Analysis

If you use Veno File Manager Project version 4.4.9, an attacker with valid credentials could access sensitive files uploaded by other users. This could lead to unauthorized data exposure, privacy breaches, or theft of confidential information if file paths and names are known.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other data protection regulations. Unauthorized access to personal or sensitive data may result in legal penalties, fines, or reputational damage due to failure to protect user data as required by these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Veno File Manager to a patched version if available. If no patch exists, restrict access to the /vfm-admin/ajax/streamvid.php endpoint via server configuration (e.g., .htaccess or firewall rules). Ensure authentication is enforced and sensitive files are not exposed.

Useful 0 Not Useful 0