CVE-2026-37068: n/a

This vulnerability involves an arbitrary file write in the /vfm-admin/index.php?section=translations&action=update endpoint of Veno File Manager Project version 4.4.9. An authenticated user with super administrator privileges can exploit this flaw by sending a specially crafted POST request, enabling them to overwrite any PHP file within the application. The vulnerability is categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impact.

Successful exploitation allows a privileged attacker to overwrite PHP files, potentially leading to arbitrary code execution, application compromise, and denial of service. The integrity and availability of the application are severely impacted. Confidentiality is not directly affected according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict super administrator access to trusted personnel only and monitor for suspicious activity related to the affected endpoint. Avoid exposing the administrative interface to untrusted networks.