What is the CVSS score of CVE-2026-37067?

CVE-2026-37067 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Veno File Manager CVE-2026-37067

EUVD-2026-67263 MEDIUM

Improper Access Control (CWE-284)

2026-08-27 mitre

GHSA-h3cw-hjxp-gp73

PHP Authentication Bypass N A

5.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible endpoint requires no authentication (PR:N, AV:N); impact confined to log data read-only disclosure (C:L), with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 28, 2026 - 22:43 vuln.today

CVSS changed

Aug 28, 2026 - 22:22 NVD

5.3 (MEDIUM)

CVE Published

Aug 27, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request.

AnalysisAI

Unauthenticated log extraction in Veno File Manager 4.4.9 exposes all application log data to any network-reachable attacker via a missing access control check on a PHP admin endpoint. The /vfm-admin/admin-panel/view/save-cvs.php script performs no authentication or authorization before processing POST requests, allowing arbitrary retrieval of log records from any specified date onward. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The `/vfm-admin/admin-panel/view/save-cvs.php` endpoint must be reachable over the network - no authentication is required per CVSS PR:N, and the vulnerability exists in a default installation of version 4.4.9 with no non-default configuration needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 5.3 Medium rating with AV:N/AC:L/PR:N/UI:N accurately reflects the low-friction nature of exploitation - no authentication, no complexity, no user interaction required from any network position. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No patched version has been identified in available intelligence - patch status from the vendor (http://veno.com) is unconfirmed and should be checked directly. … Detailed patch versions, workarounds, and compensating controls in full report.