https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 20:47:12 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-111936 <p>Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory.</p> <p>Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory.</p> https://db.gcve.eu/vuln/fkie_cve-2026-111936 https://db.gcve.eu/vuln/ghsa-37hh-79v8-v8vr <p>Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory.</p> <p>Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory.</p> https://db.gcve.eu/vuln/ghsa-37hh-79v8-v8vr