EUVD-2026-67259
GHSA-g5hf-q3px-mccp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with rename-permitted account
-
DeliverySend crafted POST to renameFile endpoint
-
ExploitRename application config file
-
ExecutionApp rebuilds config, resets super-admin to defaults
-
PersistLog in as super administrator
-
ImpactFull application takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Veno File Manager 4.4.9 account that has been granted the 'rename' permission - this is the exact prerequisite named in the description, so exploitation is NOT possible against a default anonymous/unauthenticated visitor. Given that account, the attacker sends a single crafted POST to the renameFile endpoint to rename the application configuration file, triggering a config rebuild that resets super-admin credentials to defaults. Limiting factors: valid credentials plus the specific rename permission are mandatory; the CVSS PR:N is inconsistent with this and should be read as PR:L. |
| Impact | The input CVSS is 9.8 with vector AV:N/AC:L/PR:N/UI:N, but this conflicts with the description, which explicitly requires 'an authenticated attacker with rename permission.' PR:N (unauthenticated) is therefore inconsistent with the stated prerequisite of an existing authenticated account with a granted permission - this should be PR:L, lowering the realistic base score to roughly 8.8. EPSS is low (0.16%, 5th percentile) and the CVE is not in CISA KEV, so there is no evidence of widespread active exploitation. However, a public PoC exists and the attack is technically simple once an account is obtained, so for any deployment that grants rename rights to non-admin users this is a high-priority, low-effort escalation path. Net: genuinely serious for multi-user VFM installs, but the raw 9.8/PR:N figure overstates reachability because valid credentials with the rename permission are required. |
| Exploit ScenarioDerived | An attacker who obtains or is legitimately issued a low-privilege VFM account with the 'rename' permission sends a crafted POST to the rename endpoint targeting the application configuration file. VFM rebuilds its configuration and resets the super administrator credentials to defaults, after which the attacker logs in as super admin and controls the entire instance. A public PoC in the jfs-jfs GitHub repository lowers the skill barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Privilege escalation in Veno File Manager 4.4.9 lets an authenticated user holding only the 'rename' permission take over the super administrator account. By sending a crafted POST request to the renameFile endpoint, the attacker renames the application configuration file, which forces the app to rebuild its configuration and reset super-admin credentials to default values. Publicly available exploit code exists (jfs-jfs GitHub repo); this is not in CISA KEV and EPSS is low (0.16%), indicating no observed mass exploitation yet.
RemediationAI
No vendor-released fixed version is identified in the provided data - upgrade to a patched Veno File Manager release once the vendor publishes one (monitor http://veno.com and the NVD advisory https://nvd.nist.gov/vuln/detail/CVE-2026-37071). As compensating controls until a patch is available: revoke the 'rename' permission from all non-trusted/non-admin roles so only super-admins can rename files (trade-off: legitimate users lose rename capability); restrict filesystem permissions so the web/app user cannot write to or rename the application configuration file (trade-off: may break in-app config changes); place the config file outside the managed file tree if the deployment allows it; and add WAF/endpoint rules to block rename POST requests targeting the configuration filename. Also monitor for unexpected super-admin credential resets and config-file rebuild events.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Veno File Manager (VFM) is a PHP-based web file management/sharing application with a role/permission model. The root cause is CWE-269 (Improper Privilege Management): the Actions::renameFile() function does not restrict rename operations to safe targets, so a low-privilege 'rename' role can act on the application's own configuration file. Because VFM regenerates configuration when the config file is missing/renamed, the rebuild path re-initializes the super-administrator account with default credentials - converting a limited file-management right into full administrative control. The CPE string 'cpe:2.3:a:n/a:n/a' is a placeholder and does not identify the vendor/product; the real affected product is Veno File Manager 4.4.9.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description requires an authenticated account with the 'rename' permission, so PR:L not PR:N; simple remote POST yields full admin takeover (C/I/A:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming the application configuration file and triggering a rebuild of configuration and resetting super administrator credentials to default values.
Executive ViewAI
Veno File Manager 4.4.9 contains a critical privilege escalation enabling any authenticated user with rename permissions to gain super-administrator access by manipulating configuration files. Publicly available exploit code exists for this vulnerability, and no vendor patch is currently available, creating significant risk of complete administrative compromise across affected installations.
Restrict rename file permissions to administrators only; implement operating-system and application-level access controls preventing low-privilege users from modifying the configuration directory; enable comprehensive audit logging of file access and rename operations; restrict network exposure of the file manager to authorized users only; enforce multi-factor authentication for all administrative accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB