Veno File Manager CVE-2026-37072

Exploitation requires network reachability to the Veno File Manager web application (version 4.4.9) and a request to the specific admin-head-updates.php endpoint; per the CVSS vector no authentication or user interaction is needed (PR:N/UI:N), so an unauthenticated remote request against a default deployment suffices to reach the vulnerable script. Limiting factors: the target must be running the affected VFM 4.4.9, the admin script/endpoint must be network-accessible (not restricted behind a proxy, VPN, or IP allowlist), and the real-world impact beyond reaching the endpoint is not detailed in the advisory, so the practical severity depends on what admin-head-updates.php exposes.

The signals are mixed. CVSS 3.1 is scored 9.8 (AV:N/AC:L/PR:N/UI:N with full C:H/I:H/A:H), implying trivially remote, unauthenticated, total compromise, and a working PoC is publicly available - factors that argue for prompt patching. Against that, EPSS is only 0.16% (5th percentile), the CVE is not in CISA KEV, and the one-sentence description asserts only 'Incorrect Access Control in admin-head-updates.php' without substantiating confidentiality, integrity, and availability impact at the High level; the full-triad 9.8 is therefore likely overstated for what may be a single exposed admin endpoint. Because Veno File Manager is a niche self-hosted tool, exposure is opportunistic rather than mass-scanned, so an operator running an internet-facing instance should still remediate quickly given the public PoC, while treating the 9.8 as an upper bound pending confirmation of the actual downstream impact.

An attacker locates an internet-facing Veno File Manager 4.4.9 instance and sends a direct HTTP request to admin-head-updates.php without any admin session, reaching administrative update functionality that should be gated behind authentication. Using the publicly available GitHub PoC, they reproduce the access-control bypass to interact with admin-scoped logic that a non-admin should never touch.