CVE-2026-86273
Received Received - Intake

Server-Side Request Forgery in Projeto-SIGA SIGA UP

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulDB

Description
A weakness has been identified in projeto-siga siga up to 11.1.1. Affected by this issue is the function DownloadExterno.getUrl of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExUtilController.java of the component HTML-to-PDF Endpoint. This manipulation of the argument html causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86273
EUVD
EUVD-2026-72258

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
projeto-siga siga From 5.4.10 (inc) to 11.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the SIGA software affecting the HTML-to-PDF conversion endpoint. The issue occurs because authentication fails open when a specific configuration property is not set, which is the default state in many deployments. The vulnerability allows unauthenticated attackers to make the SIGA server request arbitrary HTTP URLs by sending a crafted POST request without an Authorization header.

Detection Guidance

Check for unusual POST requests to /sigaex/public/app/util/html-pdf without an Authorization header. Monitor server logs for outbound requests to unexpected internal or external URLs. Use network scanning tools to detect SSRF attempts targeting internal services or loopback addresses.

Impact Analysis

An attacker could exploit this to make the SIGA server fetch external or internal resources. This could lead to unauthorized access to internal services, scanning of private networks, or causing resource exhaustion resulting in denial-of-service conditions. The impact includes potential data exposure and disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized internal network access or data exposure could result in regulatory penalties and loss of trust.

Mitigation Strategies

Enforce authentication on the HTML-to-PDF endpoint. Set util.webservice.password in standalone.xml to prevent open authentication. Block requests to loopback, private, and link-local IP ranges. Restrict allowed URL schemes and destinations. Implement connection and response size limits to prevent resource exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86273. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart