Veno File Manager Project 4.4.9 is vulnerable to arbitrary file deletion through manipulation of the remove query parameter in the admin translations update endpoint. The flaw allows a user to specify a file path that is then deleted on the server without proper authorization checks, which can lead to loss of data, disruption of service, or removal of critical system files. The weakness aligns with improper access control and path traversal issues.

The affected product is Veno File Manager Project version 4.4.9. No other vendors or product versions are listed in the current data.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploits at the time of analysis. The likely attack vector is a remote web request to /vfm-admin/index.php with a crafted remove parameter. An attacker with sufficient privileges could delete arbitrary files, potentially causing data loss or denial of service. Because the flaw allows deletion of any file specified by the attacker, the risk to confidentiality, integrity, and availability is high until the system is upgraded or otherwise mitigated.