External risk intelligence

Veno File Manager Arbitrary File Deletion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-37065

Veno File Manager is a web-based application designed to be deployed as an internet-facing file management and sharing service. Because it serves as a public-facing web portal for users to interact with files, it is commonly accessible via the public internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in Veno File Manager, a web-based application used for file management and sharing. The flaw allows for arbitrary file deletion, meaning an attacker could potentially remove files without proper authorization. Given the application's nature as a public-facing service, this poses a significant risk if exploited.

Unauthorized file deletion is possible.
Confirm if this file manager is in use.
Focus on confirming relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can initiate an attack by accessing the Veno File Manager Project over the network. No authentication is required to reach the vulnerable component, which is the file update functionality within the `index.php` script. This vulnerability allows an attacker to delete arbitrary files on the server, potentially leading to data loss or disruption of service.

No authentication required for access.
Triggered via a specific URL parameter.
Risk of arbitrary file deletion.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to delete arbitrary files on a Veno File Manager installation when an administrator accesses the translations page with a specially crafted URL. The impact is limited to the deletion of files, and no system data or PII is explicitly mentioned as being at risk.

Arbitrary files on the server.
Via crafted URLs to admin interface.
Uncontrolled file deletion.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Veno File Manager, being a web-based application, is likely managed by infrastructure or platform teams responsible for its deployment and availability. The first practical step involves identifying all instances of this technology within your environment, assessing their external reachability and business criticality, and then locating the accountable system owner. Once identified, a risk-based remediation plan can be developed, potentially involving vendor coordination or temporary risk reduction measures.

Infrastructure or Platform teams should own this issue.
Verify external reachability and business criticality.
Plan vendor coordination and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Veno File Manager?

Veno File Manager is a web-based application designed for hosting, managing, and sharing files. It provides a browser-based interface that allows users to upload, download, and organize digital content on a server. Organizations typically deploy it as a centralized, internet-facing portal to facilitate easy file access for remote users or clients, which makes it a core component of their data sharing infrastructure.

What does CVE-2026-37065 mean?

This vulnerability is an instance of Improper Neutralization of Directives in Pathnames, or CWE-552. In plain terms, the application fails to properly validate the file paths provided by a user. Because of this, the software can be tricked into deleting files outside of the intended directory. This gives an attacker the ability to remove critical system files or application data that they should never have permission to access.

How is this vulnerability triggered?

The flaw is triggered by sending a specific, crafted request to the translation update feature within the admin interface. Critically, the attack path does not require the user to be logged in; the application processes the request without verifying the requester's identity. Simply browsing the application normally or accessing public file download links does not trigger this issue, as it requires interaction with the specific vulnerable URL parameter.

Is my server at risk?

If you host this software, your risk is elevated because Halo Surface Signal identifies Veno File Manager as a tool commonly deployed as an internet-facing portal. Since the vulnerability is reachable over the network without authentication, any instance exposed to the public internet is potentially accessible to remote actors. You should prioritize assessing instances that are configured for external access, as these are the most likely targets for this type of network-based attack.

What should I do first to secure my setup?

Your first step is to perform an inventory to locate every instance of Veno File Manager running in your environment. Once you have identified all installations, determine which ones are reachable from the internet versus those restricted to internal networks. After identifying the systems, coordinate with the specific business owners to assess the criticality of the data hosted there and prepare to apply patches or risk reduction measures as they become available from the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.