CVE-2026-111936: Server-Side Request Forgery (SSRF) in aleksey-hoffman Sigma File Manager

CVE-2026-111936 is a server-side request forgery vulnerability in Sigma File Manager through version 2.2.0. The root cause is that the validate_remote_url() function in security.rs fails to check the resolved IP addresses when processing extension download commands. This flaw allows an attacker to craft malicious extensions or catalog entries that use hostnames resolving to internal network addresses such as loopback, private IP ranges, or cloud metadata endpoints. Exploiting this can lead to unauthorized reading of internal responses by writing files to the extension directory.

An attacker can exploit this vulnerability to perform SSRF attacks that bypass IP address validation, potentially accessing internal network resources or cloud metadata services. This could lead to unauthorized disclosure of sensitive internal information. However, there is no indication of privilege escalation, remote code execution, or other impacts beyond information disclosure. The vulnerability requires user interaction (UI:P) and has low complexity (AC:L).

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid installing untrusted extensions or catalog entries and restrict network access where possible to limit exposure to internal resources.