CVE-2026-86273 in siga
Summary
by MITRE • 09/07/2026
A weakness has been identified in projeto-siga siga up to 11.1.1. Affected by this issue is the function DownloadExterno.getUrl of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExUtilController.java of the component HTML-to-PDF Endpoint. This manipulation of the argument html causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The identified vulnerability in projeto-siga, specifically within versions up to 11.1.1, represents a critical server-side request forgery flaw located in the HTML-to-PDF endpoint component. The root cause resides in the DownloadExterno.getUrl function found in the ExUtilController.java file of the sigaex module. This architectural weakness stems from an improper validation and sanitization mechanism applied to user-supplied input before it is processed by the application's internal HTTP client or PDF generation engine. When a remote attacker provides maliciously crafted data as part of the html argument, the system fails to restrict the destination URLs to a predefined whitelist of safe domains. Consequently, instead of fetching content from legitimate external sources for conversion into PDF format, the server processes requests directed at arbitrary endpoints controlled by the adversary. This lack of input validation allows an attacker to manipulate the application's behavior in ways that were never intended by its developers, effectively turning the server into a proxy for unauthorized network access.
The operational impact of this vulnerability is severe due to its remote exploitability and the nature of Server-Side Request Forgery attacks. Because the flaw can be initiated remotely without requiring authentication or prior interaction with other parts of the system, it presents a high-risk vector for initial compromise in many deployment scenarios. An attacker leveraging this weakness can perform internal network reconnaissance by probing services that are not exposed to the public internet but are accessible from within the server's network segment. This includes accessing local management interfaces, database ports, or internal microservices running on localhost or private IP ranges. Furthermore, if the application runs with elevated privileges or has access to sensitive cloud metadata endpoints such as AWS EC2 instance metadata service, an attacker could potentially extract authentication credentials and other confidential configuration data. The public availability of exploit code significantly lowers the barrier for entry, enabling less sophisticated threat actors to execute these attacks against vulnerable instances, thereby increasing the likelihood of successful exploitation in the wild.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), which describes weaknesses where an application retrieves data from a remote server specified by the user without proper validation. The attack technique is also mapped to MITRE ATT&CK Tactic TA0001 Initial Access and specifically Technique T1564 Hidden Files and Directories or more accurately T1071 Application Layer Protocol if used for exfiltration, but primarily falls under SSRF patterns often associated with reconnaissance activities like T1046 Network Service Discovery. The failure to enforce strict output control on the URL parameter allows the attacker to bypass network-level security controls that might otherwise protect internal resources from external access attempts.
Mitigation strategies must focus on implementing robust input validation and restricting outbound network connections at both the application and infrastructure levels. At the code level, developers should implement a whitelist approach for allowed domains or IP addresses in the DownloadExterno.getUrl function, ensuring that only pre-approved URLs are processed for PDF generation. It is also advisable to reject any URL schemes other than HTTP and HTTPS and to prevent redirects by following them strictly within the permitted domain list. On an infrastructure level, network segmentation should be enforced so that the server hosting projeto-siga cannot initiate connections to sensitive internal services or cloud metadata endpoints unless absolutely necessary. Additionally, deploying a web application firewall with rules specifically designed to detect SSRF patterns can provide an additional layer of defense by blocking requests targeting private IP ranges or known malicious domains until the underlying code vulnerability is patched in a future release of the software.