CVE-2026-111936

Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/aleksey-hoffman/sigma-file-manager/blob/v2.2.0/src-tauri/src/extensions/filesystem.rs
https://github.com/aleksey-hoffman/sigma-file-manager/blob/v2.2.0/src-tauri/src/extensions/security.rs
https://github.com/aleksey-hoffman/sigma-file-manager/commit/45cedf892f800c6b140b0e3cd6e55fdbcf2cf479
https://github.com/aleksey-hoffman/sigma-file-manager/issues/552
https://www.vulncheck.com/advisories/sigma-file-manager-through-2.2.0-ssrf-via-extension-download-commands

Configurations

No configuration.

History

19 Oct 2026, 14:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-19 14:17

Updated : 2026-10-22 03:16

NVD link : CVE-2026-111936

Mitre link : CVE-2026-111936

CVE.ORG link : CVE-2026-111936

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-111936", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-111936", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-22T02:46:27.586788Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/aleksey-hoffman/sigma-file-manager", "vendor": "aleksey-hoffman", "product": "Sigma File Manager", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.2.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-19T14:17:01.200", "references": [{"url": "https://github.com/aleksey-hoffman/sigma-file-manager/blob/v2.2.0/src-tauri/src/extensions/filesystem.rs", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/aleksey-hoffman/sigma-file-manager/blob/v2.2.0/src-tauri/src/extensions/security.rs", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/aleksey-hoffman/sigma-file-manager/commit/45cedf892f800c6b140b0e3cd6e55fdbcf2cf479", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/aleksey-hoffman/sigma-file-manager/issues/552", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/sigma-file-manager-through-2.2.0-ssrf-via-extension-download-commands", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory."}], "lastModified": "2026-10-22T03:16:32.360", "sourceIdentifier": "disclosure@vulncheck.com"}