PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-37067 Veno CVE debrief

CVE-2026-37067 is a medium-severity vulnerability in Veno File Manager Project 4.4.9, allowing unauthenticated attackers to extract application logs via a crafted POST request. This vulnerability affects defenders responsible for Veno File Manager Project deployments, who should assess exposure and verify access controls. The CVE record was published on 2026-08-27T20:17:42.543Z and has not been modified since then. The vulnerability has a CVSS score of 5.3 and a CVSS severity of MEDIUM.

Vendor
Veno
Product
Veno File Manager Project
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-27
Original CVE updated
2026-09-09
Advisory published
2026-08-27
Advisory updated
2026-09-09

Who should care

Defenders responsible for Veno File Manager Project deployments should assess exposure and verify access controls. They should review and update access controls for the admin panel and verify Veno File Manager Project version and configuration. Defenders should also assess potential log extraction and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-37067 allows unauthenticated log extraction in Veno File Manager Project 4.4.9, requiring defenders to verify exposure and assess potential impact.

  • Potential log extraction by unauthenticated attackers
  • Verification of access controls and configuration required

Technical summary

CVE-2026-37067 is a medium-severity vulnerability in Veno File Manager Project 4.4.9, allowing unauthenticated attackers to extract application logs via a crafted POST request. The vulnerability is caused by incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php. Defenders should prioritize verifying exposure and assessing potential log extraction. The CVE description notes incorrect access control in Veno File Manager Project 4.4.9, allowing unauthenticated log extraction via a crafted POST request.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential log extraction.

Recommended defensive actions

  • Verify Veno File Manager Project version and configuration
  • Assess exposure to potential log extraction
  • Review and update access controls for the admin panel

Evidence notes

The CVE description notes incorrect access control in Veno File Manager Project 4.4.9, allowing unauthenticated log extraction via a crafted POST request.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-37067 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-37067

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-37067 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-37067

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.