# CVE-2026-37068: Veno File Manager arbitrary file write in translation handler

Source: https://junglewise.ai/threats/cve-2026-37068-veno-file-manager-arbitrary-file-write-in-translation-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-37068 · Severity: high · CVSS 8.1 · Published 2026-08-27

Veno File Manager is a web-based file management application used to store and organize documents. This vulnerability allows authenticated administrators to overwrite any PHP file in the application through a specially crafted request, potentially leading to complete compromise of the application and unauthorized access to sensitive data. An attacker with admin credentials can inject malicious code to take over the system.

Technologies: [Veno File Manager Project](https://junglewise.ai/threats/technologies/file-manager-project). Vendors: [Veno](https://junglewise.ai/threats/vendors/veno).

## Quick answers

**Is CVE-2026-37068 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-37068 being exploited in the wild.

**How severe is CVE-2026-37068?** High severity, with a CVSS score of 8.1, published 27 August 2026.

**Which products and versions are affected?** Veno File Manager Project 4.4.9.

**Is there a fix for CVE-2026-37068?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-37068 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-37068?** Check whether you run Veno File Manager Project at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an arbitrary file write flaw in the translation update handler at /vfm-admin/index.php?section=translations&action=update. The vulnerable component fails to properly validate the file path or content before writing to disk, allowing an authenticated super administrator to overwrite arbitrary PHP files via a crafted POST request. This is a post-authentication vulnerability requiring super administrator role; however, once exploited, it enables arbitrary code execution. A patch or fix version availability is not mentioned in the advisory materials reviewed.

## Affected products

- Veno File Manager Project 4.4.9

## Timeline

- 2026-08-27: disclosed

## References

- [http://veno.com/](http://veno.com/)
- [https://github.com/jfs-jfs/CVE-2026-37068](https://github.com/jfs-jfs/CVE-2026-37068)

## Related threats

- [Veno File Manager Project arbitrary file rename privilege escalation](https://junglewise.ai/threats/cve-2026-37071-veno-file-manager-project-arbitrary-file-rename-privilege)
- [Veno File Manager Project arbitrary file deletion](https://junglewise.ai/threats/cve-2026-37065-veno-file-manager-project-arbitrary-file-deletion)