CVE-2026-37065

CVE-2026-37065 is an unauthenticated arbitrary file deletion flaw (CWE-552) affecting version 4.4.9 of Veno File Manager (VFM), a self-hosted PHP file management/sharing application. It is triggered through the translations update action at /vfm-admin/index.php?section=translations&action=update&remove=, where the remove parameter can be abused to delete files at attacker-chosen paths on the web server without authentication. Per the CVSS 9.1 (critical) score, no privileges or user interaction are required and the attack yields high integrity and availability impact (deletion of critical application or configuration files can cause loss of data and denial of service), with no confidentiality impact. Anyone running VFM 4.4.9 is potentially affected; the data does not specify whether other versions are affected or which version contains the fix. There is currently no evidence of exploitation: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS estimates only about a 0.4% probability of exploitation within 30 days.

What to do: Inventory any VFM deployments, verify the running version, and upgrade to the vendor's patched release when one is published (the CVE data does not state a fixed version, so check the vendor/CodeCanyon changelog). Until patched, restrict access to /vfm-admin/ (HTTP authentication or IP allowlisting) and check the host for signs of deletion such as missing configuration or application files. Given the unauthenticated, low-complexity nature of the flaw, treat patching as a priority even though no in-the-wild exploitation is yet reported.