CVE-2026-37067 in File Manager
Summary
by MITRE • 08/27/2026
Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified within the Veno File Manager Project version 4.4.9 represents a critical failure in access control mechanisms, specifically located in the file /vfm-admin/admin-panel/view/save-cvs.php. This flaw permits an unauthenticated attacker to bypass authentication requirements and perform unauthorized actions that should be restricted to privileged users or completely inaccessible without valid credentials. The core of the issue lies in the improper validation of user permissions before processing incoming requests, allowing external actors to interact with sensitive administrative functions directly through crafted network traffic.
The technical nature of this flaw is classified as an incorrect access control vulnerability, which aligns with CWE-284: Improper Access Control. In a properly secured application, any request targeting administrative endpoints must be verified against the user's session state and role permissions before execution. However, in this specific instance, the server fails to enforce these checks for the save-cvs.php endpoint. This oversight allows an attacker who has network access to the target system to send specially crafted POST requests that are processed as if they originated from a legitimate administrator. The lack of authentication enforcement means there is no barrier preventing unauthorized entities from invoking backend logic designed for internal management tasks.
The operational impact of this vulnerability is severe, primarily due to the ability it grants an attacker to extract application logs starting from any desired date forward. Application logs often contain sensitive information such as user session tokens, database query details, error messages revealing stack traces or file paths, and potentially credentials if logging configurations are not strictly sanitized. By extracting these logs, an attacker can conduct extensive reconnaissance on the underlying infrastructure. This data can be leveraged to identify other vulnerabilities within the application architecture, map out network topology, or harvest sensitive information that facilitates further attacks such as session hijacking or privilege escalation. The ability to specify a date range allows for targeted extraction of historical data, potentially exposing past security incidents or configuration changes that could aid in long-term exploitation strategies.
This vulnerability is also associated with CWE-209: Generation of Error Message Containing Sensitive Information if the logs themselves expose such details, and it facilitates information disclosure which falls under MITRE ATT&CK technique T1504: Web Session Cookie access or general data exfiltration depending on how the extracted log files are utilized. The attacker's ability to retrieve arbitrary amounts of historical data significantly increases the blast radius of a single initial compromise point.
Mitigation strategies must focus on implementing robust authentication and authorization checks at every administrative endpoint. Developers should ensure that all requests to admin panels, particularly those involving file operations or system configuration like log management, are validated against active user sessions with appropriate privileges. Input validation alone is insufficient; strict access control lists (ACLs) must be enforced server-side for each action. Additionally, logging mechanisms should be reviewed to ensure they do not store sensitive data such as passwords or full stack traces in plain text. Implementing rate limiting and monitoring for unusual patterns of log extraction can also help detect and mitigate exploitation attempts while patches are being deployed. Updating the Veno File Manager Project to a version where this access control flaw has been remediated is essential for restoring security posture.