Veno File Manager Project version 4.4.9 contains a flaw that allows an attacker to delete any file on the hosting server by sending a specially crafted request to the admin translations update endpoint, as indicated by the URL /vfm-admin/index.php?section=translations&action=update&remove=. This flaw represents a CWE-552 weakness, enabling arbitrary file deletion without proper validation of the file path. The description does not state the authentication requirements for this endpoint, so this aspect is inferred rather than confirmed.

Only Veno File Manager Project 4.4.9 is explicitly listed as affected in the available data; no other vendors or products are mentioned.

The vulnerability carries a CVSS score of 9.1, classifying it as Critical, and an EPSS score of less than 1 %, indicating a low probability of exploitation at this time. It is not listed in the CISA KEV catalog. The likely attack vector is a remote web request to the aforementioned endpoint. Because the endpoint is part of the admin interface, it is reasonable to infer that some level of administrative access or the ability to gain it may be required, though the description does not state this explicitly. Successful exploitation would enable arbitrary deletion of files, compromising the integrity and availability of the affected system.