GCVE - cpe:2.3:a:aleksey-hoffman:sigma_file

Approved changes feed: RSS · Atom

cpe:2.3:a:aleksey-hoffman:sigma_file_manager:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Aleksey Hoffman (`57c2f1c7-7c4b-5b92-a00b-a20650a68d15`)
Product	Sigma File Manager (`2a0fb6c4-23bf-5984-9d80-bd21a287583c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-111936`	vulnerable	2026-11-03 10:16:11.111583	Sigma File Manager through 2.2.0 SSRF via Extension Download Commands MEDIUM (4.3) Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory. Published: 2026-10-19T13:55:10.311Z Updated: 2026-10-22T02:46:37.174Z Open on db.gcve.eu Reference links https://github.com/aleksey-hoffman/sigma-file-manager/issues/552 https://github.com/aleksey-hoffman/sigma-file-manager/commit/45cedf892f800c6b140b0e3cd6e55fdbcf2cf479 https://github.com/aleksey-hoffman/sigma-file-manager/blob/v2.2.0/src-tauri/src/extensions/security.rs https://github.com/aleksey-hoffman/sigma-file-manager/blob/v2.2.0/src-tauri/src/extensions/filesystem.rs https://www.vulncheck.com/advisories/sigma-file-manager-through-2.2.0-ssrf-via-extension-download-commands	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.