Veno File Manager
Monthly
Arbitrary file deletion in Veno File Manager (VFM) 4.4.9 lets attackers destroy files outside the intended scope by supplying a crafted path in the `remove=` parameter of the translations-update handler (/vfm-admin/index.php?section=translations&action=update). Because path traversal is not neutralized, an attacker can delete configuration, application, or user files anywhere the web server has write access, enabling denial of service, defacement, or removal of security-relevant files. Publicly available exploit code exists (GitHub PoC), though EPSS remains low (0.16%) and the flaw is not in CISA KEV.
Absolute server filesystem path disclosure in Veno File Manager 4.4.9 is exploitable by unauthenticated remote attackers via a bundled third-party library example file left accessible in production. The file /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php - a demo script from the grandt/php-relativepath Composer package - outputs the server's absolute installation path when retrieved with a plain GET request, requiring no credentials or special conditions. A public proof-of-concept repository exists at github.com/jfs-jfs/CVE-2026-37069; no active exploitation has been confirmed in CISA KEV, and EPSS stands at 0.16% (6th percentile), indicating minimal in-the-wild interest.
Arbitrary file deletion in Veno File Manager (VFM) 4.4.9 lets attackers destroy files outside the intended scope by supplying a crafted path in the `remove=` parameter of the translations-update handler (/vfm-admin/index.php?section=translations&action=update). Because path traversal is not neutralized, an attacker can delete configuration, application, or user files anywhere the web server has write access, enabling denial of service, defacement, or removal of security-relevant files. Publicly available exploit code exists (GitHub PoC), though EPSS remains low (0.16%) and the flaw is not in CISA KEV.
Absolute server filesystem path disclosure in Veno File Manager 4.4.9 is exploitable by unauthenticated remote attackers via a bundled third-party library example file left accessible in production. The file /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php - a demo script from the grandt/php-relativepath Composer package - outputs the server's absolute installation path when retrieved with a plain GET request, requiring no credentials or special conditions. A public proof-of-concept repository exists at github.com/jfs-jfs/CVE-2026-37069; no active exploitation has been confirmed in CISA KEV, and EPSS stands at 0.16% (6th percentile), indicating minimal in-the-wild interest.