Authenticated cross-user file read via unchecked stream request

Incorrect access control in Veno File Manager 4.4.9 allows remote authenticated users to read other users' uploaded files via HTTP. The /vfm-admin/ajax/streamvid.php endpoint accepts an attacker-supplied file path and name, then streams the file without checking that it belongs to a directory assigned to the requester. Exploitation requires a valid account and knowledge of the target file's path and name; the reported consequence is cross-user file disclosure.