Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with… (CVE-2026-37068)

CVE-2026-37068 describes an arbitrary file write vulnerability in Veno File Manager Project version 4.4.9. The vulnerability is located in the /vfm-admin/index.php file when accessed with the parameters section=translations and action=update. An authenticated user with the super administrator role can exploit this flaw by crafting a POST request that overwrites arbitrary PHP files in the application, potentially leading to code execution or persistent compromise.

An attacker with super administrator privileges can overwrite any PHP file in the application, which may allow them to execute arbitrary code, alter application behavior, or maintain persistent access. This compromises the integrity and security of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict super administrator access to trusted users only and monitor for suspicious activity related to file modifications in the application.