CVE-2026-37071: n/a

This vulnerability exists in the Actions::renameFile() function of Veno File Manager Project 4.4.9. An authenticated user with rename permission can perform an arbitrary file rename operation on the application configuration file. This triggers a configuration rebuild process that resets the super administrator credentials to default values, enabling privilege escalation to the highest level. The CVSS score is 9.8, indicating critical severity. No patch or remediation information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated attacker with rename permission to escalate privileges to the super administrator level by resetting the super administrator credentials to default. This results in full control over the application, compromising confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict rename permissions to trusted users only and monitor for suspicious rename operations targeting configuration files.