# CVE-2026-37065: Veno File Manager Project arbitrary file deletion

Source: https://junglewise.ai/threats/cve-2026-37065-veno-file-manager-project-arbitrary-file-deletion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-37065 · Severity: critical · CVSS 9.1 · Published 2026-08-27

Veno File Manager Project is a web-based file management application. Version 4.4.9 contains a flaw that allows authenticated administrators to delete arbitrary files from the server by manipulating request parameters. An attacker with superadmin privileges can delete critical application files (such as index.php), causing the application to malfunction or become unavailable entirely.

Technologies: [Veno File Manager Project](https://junglewise.ai/threats/technologies/file-manager-project). Vendors: [Veno](https://junglewise.ai/threats/vendors/veno).

## Quick answers

**Is CVE-2026-37065 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-37065 being exploited in the wild.

**How severe is CVE-2026-37065?** Critical severity, with a CVSS score of 9.1, published 27 August 2026.

**Which products and versions are affected?** Veno File Manager Project 4.4.9.

**Is there a fix for CVE-2026-37065?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-37065 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-37065?** Check whether you run Veno File Manager Project at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an arbitrary file deletion vulnerability in the translation update functionality at /vfm-admin/index.php. An authenticated attacker with superadmin role can craft a POST request with a malicious "remove" URL parameter to specify any file path for deletion. No additional user interaction is required beyond authentication. The vulnerable component fails to properly validate or restrict which files can be deleted, allowing deletion of critical application files that can completely disrupt service availability.

## Affected products

- Veno File Manager Project 4.4.9

## Timeline

- 2026-08-27: disclosed

## References

- [http://veno.com/](http://veno.com/)
- [https://github.com/jfs-jfs/CVE-2026-37065](https://github.com/jfs-jfs/CVE-2026-37065)

## Related threats

- [Veno File Manager Project arbitrary file rename privilege escalation](https://junglewise.ai/threats/cve-2026-37071-veno-file-manager-project-arbitrary-file-rename-privilege)
- [Veno File Manager arbitrary file write in translation handler](https://junglewise.ai/threats/cve-2026-37068-veno-file-manager-arbitrary-file-write-in-translation-handler)