CVE-2026-111936
CVE-2026-111936 · Sigma File Manager through 2.2.0 SSRF via Extension Download Commands
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory.
CVSS 5.3 · Media · EPSS 0,3%
- Publicación
- Actualización
Productos y versiones afectados
sigma file manager
- Versiones
- ≥ 0, ≤ 2.2.0: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/aleksey-hoffman/sigma-file-manager/issues/552
- https://github.com/aleksey-hoffman/sigma-file-manager/commit/45cedf892f800c6b140b0e3cd6e55fdbcf2cf479
- https://github.com/aleksey-hoffman/sigma-file-manager/blob/v2.2.0/src-tauri/src/extensions/security.rs
- https://github.com/aleksey-hoffman/sigma-file-manager/blob/v2.2.0/src-tauri/src/extensions/filesystem.rs
- https://www.vulncheck.com/advisories/sigma-file-manager-through-2.2.0-ssrf-via-extension-download-commands
- https://nvd.nist.gov/vuln/detail/CVE-2026-111936