CVE-2026-37069: n/a

This vulnerability involves an absolute path disclosure in the file /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php of Veno File Manager Project version 4.4.9. By sending a GET request to this endpoint, an unauthenticated attacker can obtain the absolute system directory path of the application. The vulnerability is classified under CWE-200 (Information Exposure). The CVSS v3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

The vulnerability allows an attacker to gain knowledge of the absolute file system path where the application is installed. This information disclosure can facilitate further targeted attacks or exploitation but does not directly compromise confidentiality, integrity, or availability beyond revealing this path.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the vulnerable endpoint if possible and monitor for suspicious requests targeting this path disclosure.