CVE-2026-37071

Deferred Deferred - Pending Action

Arbitrary File Rename Leading to Privilege Escalation in Veno File Manager

Publication date: 2026-08-27

Last updated on: 2026-09-02

Assigner: MITRE

Description

Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming the application configuration file and triggering a rebuild of configuration and resetting super administrator credentials to default values.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-02

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-37071

Affected Vendors & Products

Vendor	Product	Version / Range
veno_file_manager_project	veno_file_manager	4.4.9
veno	file_manager	4.4.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authenticated attacker with 'rename' permission to exploit a flaw in the Actions::renameFile() function of Veno File Manager Project 4.4.9. By sending a specially crafted POST request, the attacker can rename the application configuration file, which triggers a configuration rebuild and resets the super administrator credentials to default values. This enables the attacker to take over the super administrator account.

Detection Guidance

To detect this vulnerability, monitor for unauthorized file renames in the Veno File Manager configuration directory. Check for POST requests targeting the renameFile() function endpoint. Review logs for changes to critical files like configuration settings.

Impact Analysis

If you use Veno File Manager Project version 4.4.9, an attacker with 'rename' permission could gain full control over the system by resetting the super administrator account. This could lead to unauthorized access, data manipulation, or complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access and control over sensitive data, violating confidentiality and integrity requirements under GDPR and HIPAA. Organizations using this software may face compliance violations, data breaches, and potential legal consequences.

Mitigation Strategies

Immediately update Veno File Manager to a patched version beyond 4.4.9. If an update is unavailable, restrict 'rename' permissions to trusted users only and monitor file renames in the application configuration directory.

Hi! I’m here to help you understand CVE-2026-37071. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70