CVE-2026-86273 Details
Description
A weakness has been identified in projeto-siga siga up to 11.1.1. Affected by this issue is the function DownloadExterno.getUrl of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExUtilController.java of the component HTML-to-PDF Endpoint. This manipulation of the argument html causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
A server-side request forgery (SSRF) vulnerability has been identified in Projeto Siga versions through 11.1.1. The issue arises in the HTML-to-PDF endpoint, specifically within the DownloadExterno.getUrl function of the ExUtilController.java file. The vulnerability allows an unauthenticated attacker to manipulate the 'html' argument, causing the server to fetch arbitrary HTTP URLs. This exploitation can be initiated remotely, and the vulnerability has been publicly disclosed.
No known patch is available. However, it is recommended to require authentication, validate URL destinations and schemes, block access to loopback and private network ranges after DNS resolution, and enforce limits on connection times, read times, and response sizes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 7, 2026CISA-ADP
Assessed Sep 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/projeto-siga/siga/ | [email protected] | Vendor |
| https://github.com/projeto-siga/siga/issues/2492 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-86273 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/904863 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/399434 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/399434/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| projeto-siga siga | >= 5.4.10, <= 11.1.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | CVE Modified | CISA-ADP |
| Sep 7, 2026 | New CVE Received | [email protected] |