Description
Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request.
Published: 2026-08-27
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in Veno File Manager Project 4.4.9. The access control check in /vfm-admin/admin-panel/view/save-cvs.php is incorrectly implemented, allowing an attacker to send a crafted POST request without authentication and receive all application logs from a specified date onward. This reflects a CWE-284 (Improper Access Control) flaw, leading to full data exposure of internal log files and compromising confidentiality.

Affected Systems

Veno File Manager Project 4.4.9 is affected. The flaw exists in the admin‑panel endpoint save‑cvs.php; no newer versions that address the issue are listed in the input.

Risk and Exploitability

The EPSS score is not available and the vulnerability is not listed in the KEV catalog, so the exact likelihood of exploitation is unknown. Nonetheless, the flaw allows unauthenticated extraction of all log data via an HTTP POST request that bypasses authentication checks. Attackers could retrieve any log starting from the requested date, potentially exposing sensitive system and user information.

Generated by OpenCVE AI on August 28, 2026 at 06:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Veno File Manager to a version that fixes the access control flaw (e.g., 4.4.10 or newer).
  • If an upgrade is not immediately possible, block or remove the /vfm-admin/admin-panel/view/save-cvs.php endpoint or enforce authentication before accessing it.
  • Reduce or sanitize logging to limit the amount of data that could be exposed, and monitor logs for anomalous access attempts.

Generated by OpenCVE AI on August 28, 2026 at 06:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access to Application Logs via Access Control Issue in Veno File Manager
Weaknesses CWE-200
CWE-284

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request.
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-27T18:54:20.922Z

Reserved: 2026-04-06T00:00:00.000Z

Link: CVE-2026-37067

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-27T20:17:42.543

Modified: 2026-08-27T20:17:42.543

Link: CVE-2026-37067

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T06:30:18Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control