Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from… (CVE-2026-37073)

The vulnerability in Veno File Manager Project 4.4.9 arises from improper access control on the /vfm-admin/ajax/sendfiles.php endpoint. An attacker without authentication can exploit this by sending a POST request with required parameters and headers to trigger the application to send emails through its SMTP server. This issue is tracked as CVE-2026-37073 and is classified under CWE-284 (Improper Access Control). The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and impact limited to integrity (unauthorized email sending).

An unauthenticated attacker can send arbitrary emails from the application's SMTP server, potentially enabling spam or phishing campaigns that appear to originate from the legitimate server. There is no direct impact on data confidentiality or system availability reported.

No patch or official fix is currently documented for this vulnerability. Users should monitor the vendor advisory for updates. Until a fix is available, restricting network access to the vulnerable endpoint or implementing additional access controls at the network or application level may reduce exposure.