A path traversal flaw in Veno File Manager Project 4.4.9 allows an attacker who has authenticated as a super administrator to read arbitrary files on the server by sending specially crafted HTTP requests to /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php. Based on the description, the attack requires authentication and super administrator privileges, so it is not an unauthenticated remote attack but can lead to disclosure of sensitive information, compromising confidentiality of server files.

The vulnerability affects Veno File Manager Project version 4.4.9, specifically the /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php endpoints. No other vendors or product versions are reported.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, indicating limited publicly known exploitation data. The flaw presents a significant confidentiality risk when a super administrator account is compromised or misused; an attacker can access any file within scope of the web server’s file system. The lack of an official patch or solution suggests that the risk remains until remedial action is taken. Prompt assessment and mitigation are advised to prevent potential data exposure.