# CVE-2026-37073: Veno File Manager Project unauthenticated email sending in admin endpoint

Source: https://junglewise.ai/threats/cve-2026-37073-veno-file-manager-project-unauthenticated-email-sending-in-admin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-37073 · Severity: medium · CVSS 5.3 · Published 2026-08-27

Veno File Manager Project is a web-based file management application. An unauthenticated attacker can send emails through the application's configured SMTP server by making a direct POST request to an administrative endpoint, potentially enabling spam campaigns or phishing attacks from a trusted email source without authorization.

Technologies: [Veno File Manager Project](https://junglewise.ai/threats/technologies/veno-file-manager-project). Vendors: [Veno File Manager Project](https://junglewise.ai/threats/vendors/veno-file-manager-project).

## Quick answers

**Is CVE-2026-37073 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-37073 being exploited in the wild.

**How severe is CVE-2026-37073?** Medium severity, with a CVSS score of 5.3, published 27 August 2026.

**Which products and versions are affected?** Veno File Manager Project 4.4.9.

**Is there a fix for CVE-2026-37073?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-37073 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-37073?** Check whether you run Veno File Manager Project at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an incorrect access control flaw in the /vfm-admin/ajax/sendfiles.php endpoint of Veno File Manager Project 4.4.9. The endpoint fails to properly validate authentication or authorization before processing email-sending requests, allowing unauthenticated attackers to craft POST requests with appropriate parameters and headers to send emails through the application's configured SMTP server. No authentication bypass or specific user interaction is required—the vulnerable endpoint is directly reachable over the network. An attacker can abuse this to send arbitrary emails from the application's trusted email account, facilitating spam, phishing, or credential harvesting campaigns. The vendor has not yet issued a patch as of the CVE publication date.

## Affected products

- Veno File Manager Project Veno File Manager Project 4.4.9

## Timeline

- 2026-08-27: disclosed

## References

- [http://veno.com/](http://veno.com/)
- [https://github.com/jfs-jfs/CVE-2026-37073](https://github.com/jfs-jfs/CVE-2026-37073)

## Related threats

- [Veno File Manager Project incorrect access control in streamvid.php](https://junglewise.ai/threats/cve-2026-37070-veno-file-manager-project-incorrect-access-control-in-streamvid)
- [Veno File Manager Project authentication bypass in save-cvs.php](https://junglewise.ai/threats/cve-2026-37067-veno-file-manager-project-authentication-bypass-in-save-cvs-php)