CVE-2026-111936: Sigma File Manager through 2.2.0 SSRF via Extension Download Commands

Q: Who is exposed to this issue?

Deployments of Sigma File Manager through 2.2.0 are exposed when an extension download command processes a malicious extension or catalog entry containing a crafted hostname.

Q: What does an attacker need to exploit it?

The attacker needs to cause an extension download command to use a hostname that resolves to a loopback, private-network, or cloud metadata address. No authentication is required, but user interaction is required.

Q: What can an attacker access?

The flaw can be used to request internal services and read their responses through files written to the extension directory. The reported impact is limited to confidentiality.

Q: How can I determine whether my deployment is affected?

Check whether Sigma File Manager is version 2.2.0 or earlier and whether extension download commands can consume extension or catalog entries from untrusted sources. Review extension-directory files for unexpected downloaded responses or extension content referencing internal-target hostnames.

Published Oct 19, 2026

Updated

Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validateremoteurl() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory.

Affected Software

1 affected component

Sigma File Manager Sigma File Manager<=2.2.0

Event History

Oct 19, 2026

CVE Published

via MITRE·01:55 PM

Data Sourced

via MITRE·01:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Deployments of Sigma File Manager through 2.2.0 are exposed when an extension download command processes a malicious extension or catalog entry containing a crafted hostname.

What does an attacker need to exploit it?

The attacker needs to cause an extension download command to use a hostname that resolves to a loopback, private-network, or cloud metadata address. No authentication is required, but user interaction is required.

What can an attacker access?

The flaw can be used to request internal services and read their responses through files written to the extension directory. The reported impact is limited to confidentiality.

How can I determine whether my deployment is affected?

Check whether Sigma File Manager is version 2.2.0 or earlier and whether extension download commands can consume extension or catalog entries from untrusted sources. Review extension-directory files for unexpected downloaded responses or extension content referencing internal-target hostnames.

CVE-2026-111936: Sigma File Manager through 2.2.0 SSRF via Extension Download Commands

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can an attacker access?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can an attacker access?

How can I determine whether my deployment is affected?