CVE-2026-111936
MEDIUM
CVSS 4.3
Published: 2026-10-19
Modified: 2026-10-19
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory.
Quick Facts
| CVE ID | CVE-2026-111936 |
| CVSS Score | 4.3 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
| Published | 2026-10-19 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |
References
- https://github.com/aleksey-hoffman/sigma-file-manager/blob/v…
- https://github.com/aleksey-hoffman/sigma-file-manager/blob/v…
- https://github.com/aleksey-hoffman/sigma-file-manager/commit…
- https://github.com/aleksey-hoffman/sigma-file-manager/issues…
- https://www.vulncheck.com/advisories/sigma-file-manager-thro…