Sigma File Manager CVE-2026-111936

Exploitation requires the victim to install or add an attacker-controlled extension or catalog entry (UI:P) whose download command specifies a hostname that DNS-resolves to a loopback (127.0.0.0/8), private (RFC1918), or cloud metadata (169.254.169.254) address; the vulnerable path is the extension download command handling in src-tauri/src/extensions/security.rs where validate_remote_url() checks the URL but not the resolved IP. Exploitation is LIMITED by: (1) the need for the user to trust/install a malicious extension or poisoned catalog entry - the app is not vulnerable to a purely unsolicited remote request; (2) confidentiality-only, Low-rated impact, since data is exfiltrated indirectly as files written to the extension directory rather than streamed back to the attacker; (3) affected versions are Sigma File Manager through 2.2.0 only. Value is highest when the app runs on a cloud instance exposing an instance-metadata endpoint.

This is a moderate, conditionally-exploitable SSRF (CWE-918) rather than a drop-everything priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N) scores 5.3 and is internally consistent with the description: network attack surface, no attacker authentication, but passive user interaction (UI:P) is required because the attack vehicle is a 'malicious extension or catalog entry' that a victim must add or trust. The real limiting factor is that initiative, not the network vector - an attacker cannot reach the vulnerable validate_remote_url() path without the user introducing an attacker-controlled extension/catalog entry. Impact is confidentiality-only and rated Low (VC:L) because the attacker reads internal/metadata responses indirectly via files written to the extension directory, with no integrity or availability effect and no confirmed scope change. No EPSS score, KEV listing, SSVC decision, or public POC was provided in the input, so exploitation probability cannot be quantified; the only exploitation signal is a VulnCheck advisory and a confirmed vendor patch, which indicate a credible, researcher-validated issue but not active exploitation. Net: a legitimate issue worth patching, especially in environments running in cloud instances where 169.254.169.254 metadata exposure matters, but the required malicious-extension precondition keeps real-world mass-exploitation risk low.

An attacker publishes or seeds a malicious Sigma File Manager extension (or a poisoned catalog entry) whose download command references a hostname that resolves to a loopback, private-range, or cloud metadata IP such as 169.254.169.254. When a victim installs or processes that extension, the application's extension download logic calls validate_remote_url(), which never validates the resolved IP, so the request is sent to the internal target and the response is written into the extension directory where it can be read. No public exploit code is identified at time of analysis, though the flaw is documented in a VulnCheck advisory and the source (security.rs) is publicly referenced.