Sigma File Manager version 2.2.0 is vulnerable to a server‑side request forgery because the URL validation routine does not check whether the resolved IP address is an internal or private address. An attacker who can install a malicious extension or catalog entry can cause the application to download a file from a host that resolves to a loopback, private or cloud metadata address. The downloaded file is written to the extension directory, allowing the attacker to observe the internal response. This flaw can expose sensitive internal data and potentially allow attackers to glean information about an organization’s network.

The flaw affects Sigma File Manager delivered by aleksey-hoffman. Version 2.2.0 of the application is vulnerable; later releases may contain the fix.

The CVSS score of 5.3 indicates moderate risk. Because the attacker must first supply or control an extension, the vulnerability is not trivially exploitable from a remote guest. However, if an attacker can supply a malicious extension or catalog entry, the SSRF could be leveraged to read internal network resources. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that public exploitation may not yet be widespread. Nevertheless, enterprises that allow user‑supplied extensions should treat the flaw as a potential threat.