See how sigma file manager compares to other vendors in security performance
Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validateremoteurl() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory.