CVE-2026-37065: n/a

CVE-2026-37065 identifies an arbitrary file deletion vulnerability in Veno File Manager Project 4.4.9. The vulnerability exists in the /vfm-admin/index.php script when accessed with parameters section=translations, action=update, and remove=. An attacker can exploit this to delete files on the server without any privileges or user interaction. The CVSS v3.1 base score is 9.1, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an unauthenticated remote attacker to delete arbitrary files on the affected server, leading to high integrity and availability impact. This can cause denial of service or loss of critical data managed by the application. There is no confidentiality impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /vfm-admin/index.php endpoint and monitor for suspicious requests targeting the translation update functionality. Implement network-level protections to limit exposure of the administrative interface.