CyberRota Analysis
AI-GeneratedThe Veno File Manager Project version 4.4.9 contains an access control vulnerability in the /vfm-admin/ajax/streamvid.php endpoint, allowing authenticated attackers to read any uploaded files from other users if they know the specific path and filename. This flaw poses a significant risk to user data confidentiality, making it critical for organizations using this file manager to prioritize patching or mitigating this vulnerability. Users and administrators of the affected software should take immediate action to secure their installations.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint.