SSRF Vulnerability in projeto-siga HTML-to-PDF Endpoint

A server-side request forgery (SSRF) vulnerability has been identified in projeto-siga siga, affecting all versions up to and including 11.1.1. The flaw resides within the HTML-to-PDF component, specifically in the DownloadExterno.getUrl function located in ExUtilController.java. An unauthenticated remote attacker can exploit this vulnerability by manipulating the 'html' argument to force the server to perform unauthorized HTTP requests. This capability can be leveraged to interact with internal network services that are otherwise inaccessible from the external perimeter, potentially leading to information disclosure or further exploitation of internal infrastructure. A proof-of-concept exploit for this vulnerability is currently publicly available, and the project maintainers have not yet provided a resolution for this issue.

Impact

Successful exploitation of CVE-2026-86273 allows remote, unauthenticated attackers to perform SSRF attacks against internal infrastructure. This can be used to bypass network access controls, perform internal service discovery, or exfiltrate sensitive data from internal systems that trust the siga application server.

Recommendation

Prioritized actions for security teams:

• Implement egress filtering at the network level to restrict the siga application server from initiating connections to sensitive internal subnets, non-public IP ranges, or internal administration interfaces.
• Deploy web application firewall (WAF) rules to inspect and sanitize the 'html' parameter in incoming requests targeting the DownloadExterno.getUrl endpoint for suspicious payloads.
• Monitor web access logs for anomalous POST or GET requests to the identified controller path originating from external IP addresses.