CVE-2026-37064 in File Manager
Summary
by MITRE • 08/27/2026
User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'user_name' parameter to test if the user exists.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in Veno File Manager Project version 4.4.9 represents a critical information disclosure flaw located within the administrative interface, specifically at the /vfm-admin/ajax/usr-check.php endpoint. This issue stems from an insecure implementation of user verification logic that fails to adequately sanitize inputs or randomize response times and payloads based on whether a specified username exists in the system database. By sending a specially crafted POST request containing a chosen 'user_name' parameter, an unauthenticated attacker can interact with this endpoint without requiring prior authentication credentials. The application's response mechanism provides distinguishable feedback that allows the attacker to determine the existence of specific user accounts. This behavior is characteristic of a classic User Enumeration vulnerability, where the system inadvertently leaks information about valid usernames through differences in HTTP status codes, response bodies, or timing delays depending on whether the queried username matches an existing record.
From a technical perspective, this flaw aligns with CWE-204, which describes Responsive Discrepancy, and is closely related to CWE-284, Improper Access Control, as it allows unauthenticated actors to probe internal user directories. The vulnerability enables attackers to build a comprehensive list of valid usernames within the application. This capability significantly lowers the barrier for subsequent attacks, particularly brute-force password guessing campaigns or targeted phishing efforts. Since file management systems often hold sensitive data and possess administrative privileges when compromised, obtaining a valid username is frequently the first step in an attack chain that leads to full system compromise. The lack of rate limiting or account lockout mechanisms on this endpoint exacerbates the risk, allowing for high-volume automated enumeration attempts without triggering security alerts.
The operational impact of this vulnerability extends beyond simple data leakage. By confirming which usernames are active, attackers can prioritize their efforts against accounts with higher privilege levels or those associated with critical business functions. This targeted approach increases the likelihood of successful credential stuffing attacks compared to random guessing. Furthermore, in environments where password policies may be weak or reused across systems, this information can facilitate lateral movement within a network if the same credentials are used elsewhere. The exposure also aids social engineering attackers who require specific names and roles to craft convincing phishing messages that bypass user skepticism.
To mitigate this vulnerability, immediate remediation should focus on modifying the usr-check.php endpoint to provide uniform responses regardless of whether the username exists in the database. This can be achieved by returning a generic success or failure message with identical HTTP status codes and response bodies for both valid and invalid usernames. Additionally, implementing strict rate limiting on authentication-related endpoints is essential to prevent automated enumeration tools from functioning effectively. Enforcing multi-factor authentication adds an additional layer of security that mitigates the risk posed by stolen credentials derived from such enumeration activities. Regular security audits and penetration testing should be conducted to identify similar logic flaws in other administrative interfaces within the application, ensuring a robust defense-in-depth strategy against information disclosure attacks.