Path Traversal Vulnerability in Veno File Manager

Veno File Manager version 4.4.9 contains a path traversal vulnerability identified as CVE-2026-37066. This flaw allows an authenticated attacker possessing the super administrator role to access and read arbitrary files on the server's filesystem. The vulnerability is triggered by sending specially crafted HTTP GET or POST requests to the administrative interface, specifically targeting the /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php files. This vulnerability poses a significant risk for sensitive information disclosure, as it allows unauthorized access to configuration files, system data, or stored credentials residing outside the intended application directory.

Attack Chain

1. Attacker gains authentication to the Veno File Manager administrative console with the super administrator role.
2. Attacker crafts a malicious HTTP GET or POST request targeting /vfm-admin/index.php or /vfm-admin/ajax/streamvid.php.
3. The request includes directory traversal sequences (such as ../) within the request parameters handled by the application.
4. The application fails to properly sanitize the input parameters before processing file read operations.
5. The application backend processes the request and resolves the traversal path to an arbitrary location on the underlying server filesystem.
6. The application retrieves the content of the target file.
7. The application returns the file contents to the attacker within the HTTP response body, resulting in unauthorized information disclosure.

Impact

Successful exploitation of this vulnerability leads to unauthorized access to arbitrary files on the host server. This can result in the exposure of sensitive configuration details, database credentials, environment variables, or private data, potentially leading to complete system compromise or lateral movement if credentials or session tokens are exfiltrated.

Recommendation

Detection engineering teams should monitor administrative traffic for anomalous directory traversal patterns.

• Deploy web server logs to monitor for requests to /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php containing directory traversal strings like ../ or ..%2f.
• Ensure administrative access to Veno File Manager is restricted to trusted source IP addresses to prevent unauthorized authentication.
• Review all logs for unauthorized access by super administrator accounts if an intrusion is suspected.