The vulnerability permits an authenticated super administrator to overwrite any PHP file via a specially crafted POST request to the translations update endpoint. This file write flaw can be leveraged to inject malicious code into the application, granting the attacker full control over the vulnerable system. The weakness stems from insufficient validation and sanitization of file paths, enabling arbitrary file modification.

Veno File Manager Project version 4.4.9 is affected. No other vendors or products are listed as impacted by this CVE.

The CVE is not listed in the CISA KEV catalog and its EPSS score is not available, indicating no known exploitation activity to date. The exploit requires authentication as a super administrator, which limits exposure to compromised or malicious privileged accounts. The absence of a publicly available exploit reduces immediate risk, but the impact of successful exploitation remains high due to potential remote code execution.