CVE-2026-37071

Veno File Manager 4.4.9 contains an improper privilege management flaw (CWE-269) in its Actions::renameFile() function that allows a file rename operation to be abused to compromise the super administrator account. An authenticated user holding the 'rename' permission can send a specially crafted POST request to the affected rename endpoint that renames the application's configuration file, triggering a configuration rebuild that resets the super administrator credentials to their default values. An attacker can then log in as the super administrator using those default credentials and take over the application. Only installations running Veno File Manager 4.4.9 are affected. The flaw is rated critical (CVSS 3.1 score 9.8), but no public proof-of-concept or in-the-wild exploitation is known, it is not listed in CISA KEV, and EPSS assigns a 0.4% probability of exploitation within 30 days.

What to do: Upgrade to the vendor's patched release as soon as one is available (the advisory does not name a fixed version, so check the Veno File Manager changelog), and in the meantime restrict the 'rename' permission to fully trusted users only. Audit installations for a renamed configuration file and reset the super administrator credentials away from their defaults, and monitor for suspicious POST requests to the file-rename endpoint.