CVE-2026-111936 — Sigma File Manager through 2.2.0 SSRF via Extension Download Commands
Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extensi…
Published: 2026-10-19 · CVSS: 5.3 · CVSS 4.0
Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7