Server-Side Request Forgery in Sigma File Manager by Aleksey Hoffman

CVE-2026-111936

What is CVE-2026-111936?

Sigma File Manager up to version 2.2.0 exhibits a server-side request forgery vulnerability. The function validate_remote_url() in security.rs fails to verify the resolved IP addresses for extension download commands. This oversight enables malicious extensions or catalog entries to exploit hostname resolutions that lead to loopback, private, or cloud metadata addresses, thereby allowing unauthorized access to internal responses via files stored in the extension directory.

References