Unrated severityNVD Advisory· Published Aug 27, 2026

CVE-2026-37066

Description

Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests (POST and GET) to the affected endpoints.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Jfs Jfs/CVE 2026 37066references
Veno File Manager Project/Veno File Managerllm-fuzzy
Range: =4.4.9

Patches

Vulnerability mechanics

References

veno.comnvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000