Executive brief
Veno File Manager is a web-based file management application used to store and organize documents. This vulnerability allows authenticated administrators to overwrite any PHP file in the application through a specially crafted request, potentially leading to complete compromise of the application and unauthorized access to sensitive data. An attacker with admin credentials can inject malicious code to take over the system.
Technical details
The vulnerability is an arbitrary file write flaw in the translation update handler at /vfm-admin/index.php?section=translations&action=update. The vulnerable component fails to properly validate the file path or content before writing to disk, allowing an authenticated super administrator to overwrite arbitrary PHP files via a crafted POST request. This is a post-authentication vulnerability requiring super administrator role; however, once exploited, it enables arbitrary code execution. A patch or fix version availability is not mentioned in the advisory materials reviewed.
Affected products
- Veno File Manager Project 4.4.9
Timeline
- 2026-08-27: disclosed