Description
Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request.
Published: 2026-08-27
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Assess Impact
AI Analysis

Impact

The vulnerability resides in Veno File Manager Project 4.4.9. The access control check in /vfm-admin/admin-panel/view/save-cvs.php is incorrectly implemented, allowing an attacker to send a crafted POST request without authentication and receive all application logs from a specified date onward. This reflects a CWE-284 (Improper Access Control) flaw, leading to full data exposure of internal log files and compromising confidentiality.

Affected Systems

Veno File Manager Project 4.4.9 is affected. The vendor is not specified in the input. The flaw exists in the admin‑panel endpoint save‑cvs.php; no newer versions that address the issue are listed in the input.

Risk and Exploitability

The EPSS score of < 1% indicates a very low, but non-zero, likelihood of exploitation, and the vulnerability is not listed in the KEV catalog. The CVSS score is 5.3, reflecting moderate risk. Nonetheless, the flaw allows unauthenticated extraction of all log data via an HTTP POST request that bypasses authentication checks. Attackers could retrieve any log starting from the requested date, potentially exposing sensitive system and user information.

Generated by OpenCVE AI on August 29, 2026 at 01:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor-released patch or upgrade to a fixed version as soon as it becomes available.
  • If an upgrade is not immediately possible, block or remove the /vfm-admin/admin-panel/view/save-cvs.php endpoint or enforce authentication before accessing it.
  • Reduce or sanitize logging to limit the amount of data that could be exposed, and monitor logs for anomalous access attempts.

Generated by OpenCVE AI on August 29, 2026 at 01:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 29 Aug 2026 01:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Log Extraction via Improper Access Control in Veno File Manager 4.4.9

Sat, 29 Aug 2026 00:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access to Application Logs via Access Control Issue in Veno File Manager
Weaknesses CWE-200

Fri, 28 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 28 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access to Application Logs via Access Control Issue in Veno File Manager
Weaknesses CWE-200
CWE-284

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request.
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-28T19:32:56.749Z

Reserved: 2026-04-06T00:00:00.000Z

Link: CVE-2026-37067

cve-icon Vulnrichment

Updated: 2026-08-28T19:32:47.020Z

cve-icon NVD

Status : Deferred

Published: 2026-08-27T20:17:42.543

Modified: 2026-09-09T16:04:24.933

Link: CVE-2026-37067

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-29T01:30:05Z

Weaknesses