CVE-2026-37068

CVE-2026-37068 is an arbitrary file write (CWE-22, path traversal) in the translation-settings handler of Veno File Manager (VFM), reachable at /vfm-admin/index.php?section=translations&action=update. An authenticated user holding the super administrator role can send a specially crafted POST request to that endpoint to overwrite any PHP file in the application. Because overwritten PHP files are executed by the web server, an attacker can effectively inject malicious code into the application, gaining remote code execution and full control of the VFM instance (CVSS 3.1: 8.1 high, integrity and availability impact). Only VFM installations running version 4.4.9, per the advisory, where the attacker has or controls a super administrator account are affected; there is no unauthenticated attack path. There is no public proof of concept, the issue is not in CISA KEV, and EPSS puts 30-day exploitation probability at about 0.4% (30th percentile), so no confirmed exploitation is known.

What to do: Upgrade VFM to a release newer than 4.4.9 once a patched version is published (the fixed version is not stated in the available data). Until then, restrict super administrator accounts to trusted operators, monitor POST requests to /vfm-admin/index.php?section=translations&action=update for unexpected writes, and audit PHP files under the application directory for recent, unexplained modifications that would indicate code injection.