CVE-2020-22550
Description
Veno File Manager 3.5.6 is affected by a directory traversal vulnerability. Using the traversal allows an attacker to download sensitive files from the server.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Veno/File Managerdescription
- Range: <=3.5.6
Patches
Vulnerability mechanics
Root cause
"Missing input validation on the `filesarray` parameter in zip.php allows directory traversal."
Attack vector
An attacker sends a POST request to `/filemanager/vfm-admin/ajax/zip.php` with a base64-encoded `filesarray` parameter containing directory traversal sequences (e.g., `../../../../../../etc/passwd`), along with valid `time` and `dash` values [ref_id=1]. The server compresses the traversed file into a ZIP archive and returns a download link. The attacker then fetches the ZIP via a GET request and extracts the file contents [ref_id=1]. No authentication is required beyond knowing the `time` and `dash` parameters.
Affected code
The vulnerable endpoint is `/filemanager/vfm-admin/ajax/zip.php` in Veno File Manager 3.5.6 [ref_id=1]. The `filesarray` parameter accepts a base64-encoded file path that is not sanitized for directory traversal sequences.
What the fix does
The advisory does not include a patch or official remediation. The researcher's PoC demonstrates that the application fails to validate or sanitize the `filesarray` parameter for path traversal sequences before passing it to the ZIP compression routine [ref_id=1]. A proper fix would reject any file path containing `../` sequences or resolve the path against an allowed base directory before processing.
Preconditions
- inputAttacker must know or guess valid 'time' and 'dash' parameters for the target Veno File Manager instance
- networkTarget must be running Veno File Manager 3.5.6 with the zip.php endpoint accessible
Reproduction
Run the PoC script with `--hostname <target> --dash <dash_value> --time <time_value>`, then enter a file path like `../../../../../../etc/passwd` when prompted [ref_id=1]. The script base64-encodes the path, sends it to `/filemanager/vfm-admin/ajax/zip.php`, downloads the resulting ZIP, and prints the file contents.
Generated on May 31, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- codecanyon.net/item/veno-file-manager-host-and-share-files/6114247mitrex_refsource_MISC
- gist.github.com/Sp3eD-X/22640377f96340544baf12891f708b8fmitrex_refsource_MISC
News mentions
0No linked articles in our index yet.