A path traversal flaw in Veno File Manager Project 4.4.9 allows an attacker who has authenticated as a super administrator to read arbitrary files on the server by sending specially crafted HTTP requests to /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php. Based on the description, the attack requires authentication and super administrator privileges, so it is not an unauthenticated remote attack but can lead to disclosure of sensitive information, compromising confidentiality of server files.

The vulnerability affects Veno File Manager Project version 4.4.9, specifically the /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php endpoints. No other vendors or product versions are reported.

The EPSS score of < 1% indicates a low probability of exploitation, and the vulnerability is not listed in CISA KEV. The CVSS score of 6.5 classifies it as a moderate severity flaw: an attacker who has authenticated with super‑administrator privileges can read arbitrary files via specially crafted requests to /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php. This disclosure risk primarily affects confidentiality, as compromised super‑administrator credentials or mis‑assignment could lead to exposure of sensitive server files. With no official patch presently available, the risk persists until remediation is applied. Prompt assessment and mitigation are advised to prevent potential data exposure.