CVE-2026-37066CWE-22path-traversal

CVE-2026-37066

Medium · published August 28, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
44.8
In the wild
Unconfirmed
What it is

Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests (POST and GET) to the affected endpoints.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00543 · 44.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-28T00:17Z
References (3)
http://veno.com · [email protected]https://github.com/jfs-jfs/CVE-2026-37066 · [email protected]https://github.com/jfs-jfs/CVE-2026-37066 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 AUG 00:00Z
    Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and…
    cvelistv5