CVE-2026-86273: Server-Side Request Forgery in projeto-siga siga

The vulnerability CVE-2026-86273 exists in the projeto-siga siga product up to versions 11.1.0 and 11.1.1. It is located in the DownloadExterno.getUrl function within the HTML-to-PDF Endpoint component. The flaw allows an attacker to manipulate the html argument, resulting in server-side request forgery (SSRF). This can be triggered remotely without authentication. The vulnerability was responsibly disclosed to the project, which has not yet issued a fix or official response. Exploit code has been publicly released, increasing the risk of potential attacks.

Successful exploitation of this SSRF vulnerability can allow an attacker to make unauthorized requests from the vulnerable server to internal or external systems. This may lead to information disclosure or interaction with internal services that are otherwise inaccessible. The CVSS score of 6.9 indicates a medium severity impact with low attack complexity and no required privileges or user interaction.

No official fix or patch is currently available from the vendor. Since the project has not responded or issued a remediation, users should consider implementing network-level protections such as restricting outbound HTTP requests from the affected server to mitigate SSRF risks. Monitor for suspicious activity related to the vulnerable endpoint. Check the vendor advisory regularly for updates or patches.