Veno File Manager 4.4.9 — Authenticated Arbitrary File Read (CVE-2026-37070)

Metadata

Affected Target

Summary

Veno File Manager 4.4.9 exposes the /vfm-admin/ajax/streamvid.php endpoint without properly restricting which files a session-authenticated user may request. A user who is only supposed to have access to their own assigned directory can instead read any uploaded file elsewhere on the server, as long as they know or can guess the path and filename. The endpoint takes a base64-encoded path via the vid GET parameter and streams the referenced file back without checking that it lies inside the caller’s permitted directory. The included PoC automates the request and saves the retrieved file locally.

Vulnerability Details

Root Cause

streamvid.php resolves the vid parameter (a base64-encoded relative path) directly against the uploads directory without verifying the requesting user’s directory scope, resulting in incorrect access control (arbitrary file read).

Attack Vector

1. Authenticate to the Veno File Manager application as any user with an assigned upload directory.
2. Capture the session cookie name/value for that account.
3. Base64-encode the path of a file believed to exist elsewhere under the uploads directory.
4. Send a GET request to /vfm-admin/ajax/streamvid.php?vid=<base64 path> with the session cookie.
5. The server streams back the file contents regardless of directory ownership.

Impact

Any authenticated user can exfiltrate files uploaded by other users, leading to disclosure of potentially sensitive documents, media, or configuration data.

Environment / Lab Setup

Target:   Veno File Manager 4.4.9 (self-hosted PHP install)
Attacker: bash, curl

Proof of Concept

PoC Script

See PoC.sh in this folder.

1

./PoC.sh <vfm cookie name> <vfm cookie value> <path/to/file> <url to root of vfm installation>/

The script base64-encodes the target file path, issues a GET request to streamvid.php with the supplied session cookie, and saves the retrieved file locally as here.mp4.

Detection & Indicators of Compromise

GET /vfm-admin/ajax/streamvid.php?vid=<base64> HTTP/1.1

Signs of compromise:

• Requests to streamvid.php with vid values decoding to paths outside the requesting user’s own directory
• Unexpected download activity from low-privilege accounts

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/jfs-jfs/CVE-2026-37070 on 2026-07-05.