Executive brief
Veno File Manager Project is a web-based file management application. Version 4.4.9 contains a flaw that allows authenticated administrators to delete arbitrary files from the server by manipulating request parameters. An attacker with superadmin privileges can delete critical application files (such as index.php), causing the application to malfunction or become unavailable entirely.
Technical details
The vulnerability is an arbitrary file deletion vulnerability in the translation update functionality at /vfm-admin/index.php. An authenticated attacker with superadmin role can craft a POST request with a malicious "remove" URL parameter to specify any file path for deletion. No additional user interaction is required beyond authentication. The vulnerable component fails to properly validate or restrict which files can be deleted, allowing deletion of critical application files that can completely disrupt service availability.
Affected products
- Veno File Manager Project 4.4.9
Timeline
- 2026-08-27: disclosed