CVE-2026-37070: n/a

The vulnerability in Veno File Manager Project 4.4.9 involves incorrect access control in the /vfm-admin/ajax/streamvid.php endpoint. An attacker with valid authentication can exploit this flaw to read arbitrary uploaded files of other users by crafting a specific GET request containing the known path and filename. This issue is classified under CWE-284 (Improper Access Control). There is no information about an official patch or remediation level, and no known exploits in the wild have been reported.

An authenticated attacker can access sensitive files uploaded by other users without authorization, potentially leading to unauthorized disclosure of confidential information. The vulnerability impacts confidentiality but does not affect integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint to trusted users only and monitor authenticated user activities closely.