Retour à la veille
CVE-2026-111936
Score CVSS
4.3
MEDIUM
Description détaillée
Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory.
Vecteur d'attaque (CVSS)
Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Références et Patchs
https://github.com/aleksey-hoffman/sigma-file-manager/blob/v2.2.0/src-tauri/src/extensions/filesystem.rshttps://github.com/aleksey-hoffman/sigma-file-manager/blob/v2.2.0/src-tauri/src/extensions/security.rshttps://github.com/aleksey-hoffman/sigma-file-manager/commit/45cedf892f800c6b140b0e3cd6e55fdbcf2cf479https://github.com/aleksey-hoffman/sigma-file-manager/issues/552https://www.vulncheck.com/advisories/sigma-file-manager-through-2.2.0-ssrf-via-extension-download-commands
Dernières Vulnérabilités
CVE-2026-77228
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
VOIR DÉTAILS
CVE-2026-77227
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
VOIR DÉTAILS
CVE-2026-77225
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
VOIR DÉTAILS