Vulnerability · Published Oct 19, 2026 · Assigned by VulnCheck

CVE-2026-111936Sigma File Manager through 2.2.0 SSRF via Extension Download Commands

Medium 4.3

In plain English

A medium-severity server-side request forgery in Sigma File Manager from aleksey-hoffman. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 82.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory.

Affected products (as reported)

Vendor	Product	Versions
aleksey-hoffman	Sigma File Manager	0 – through 2.2.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

https://github.com/aleksey-hoffman/sigma-file-manager/issues/552 issue-tracking
https://github.com/aleksey-hoffman/sigma-file-manager/commit/45cedf892f800c6b140b0e3cd6e55fdbcf2cf479 patch
https://github.com/aleksey-hoffman/sigma-file-manager/blob/v2.2.0/src-tauri/src/extensions/security.rs technical-description
https://github.com/aleksey-hoffman/sigma-file-manager/blob/v2.2.0/src-tauri/src/extensions/filesystem.rs technical-description
VulnCheck Advisory: Sigma File Manager through 2.2.0 SSRF via Extension Download Commands third-party-advisory