CVE-2026-86273: Projeto-Siga SSRF Vulnerability

CVE-2026-86273 Overview

CVE-2026-86273 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting projeto-siga siga versions up to 11.1.1. The flaw resides in the DownloadExterno.getUrl function within sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExUtilController.java, part of the HTML-to-PDF endpoint. Attackers manipulate the html argument to coerce the server into issuing arbitrary requests. The attack is remotely exploitable and requires no authentication or user interaction. A public exploit has been disclosed. The project maintainers were notified through an issue report but have not responded.

Critical Impact
Unauthenticated remote attackers can abuse the HTML-to-PDF endpoint to force the server to fetch arbitrary URLs, potentially exposing internal services, cloud metadata endpoints, and internal network resources.

Affected Products

projeto-siga siga versions up to and including 11.1.1
Component: HTML-to-PDF Endpoint (ExUtilController.java)
Function: DownloadExterno.getUrl

Discovery Timeline

2026-09-07 - CVE-2026-86273 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86273

Vulnerability Analysis

The vulnerability affects the HTML-to-PDF conversion functionality exposed by the siga document management platform. The DownloadExterno.getUrl method in ExUtilController.java processes user-supplied HTML content and fetches referenced resources server-side to render them into a PDF document. Because the fetching logic does not validate or restrict destination URLs, an attacker can supply crafted HTML containing references to arbitrary internal or external endpoints. The server then issues outbound HTTP requests on the attacker's behalf, returning or processing responses that may include internal service data.

SSRF vulnerabilities in HTML-to-PDF pipelines are common because rendering engines follow embedded resource references such as images, iframes, and stylesheets without applying network-layer allowlists.

Root Cause

The root cause is missing validation of URLs handled by DownloadExterno.getUrl when processing the html argument. The endpoint does not enforce an allowlist of permitted hosts, block requests to private IP ranges (RFC 1918, loopback, link-local), or restrict URL schemes. Any URL embedded in the submitted HTML is fetched by the server.

Attack Vector

An unauthenticated remote attacker submits crafted HTML to the HTML-to-PDF endpoint. The HTML contains references to internal targets such as http://169.254.169.254/latest/meta-data/ for cloud instance metadata, http://127.0.0.1:<port>/ for locally bound services, or internal management interfaces reachable from the siga host. The server processes the HTML, follows the embedded references, and may return content or expose behavioral signals through response timing and error messages.

Refer to the GitHub Issue #2492 and the VulDB CVE-2026-86273 entry for additional technical context.

Detection Methods for CVE-2026-86273

Indicators of Compromise

Outbound HTTP requests from the siga application server to internal IP ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254.
Unusual invocation patterns of the HTML-to-PDF endpoint containing external or internal URLs within the html parameter.
Application logs showing DownloadExterno.getUrl fetching non-standard hosts or non-HTTP schemes.

Detection Strategies

Inspect web server and reverse proxy logs for POST requests to the siga HTML-to-PDF endpoint carrying URL references in HTML payloads.
Correlate application-layer logs from ExUtilController with egress network flow logs to identify anomalous destinations.
Deploy web application firewall (WAF) rules that flag HTML submissions containing references to private address space, metadata endpoints, or non-HTTP schemes.

Monitoring Recommendations

Monitor egress traffic from application servers hosting siga and alert on connections to internal management interfaces, private IP ranges, and cloud metadata services.
Track baseline request volume to the HTML-to-PDF endpoint and alert on spikes or requests from unauthenticated sessions.
Enable full request-body logging for the affected endpoint to preserve forensic evidence of exploitation attempts.

How to Mitigate CVE-2026-86273

Immediate Actions Required

Restrict network egress from the siga application server using host-based firewalls or cloud security groups, blocking access to internal ranges and metadata services (169.254.169.254, fd00::/8).
Place the HTML-to-PDF endpoint behind authentication if it is currently exposed to unauthenticated users.
Deploy WAF signatures that inspect the html parameter and reject payloads referencing private IP ranges or non-HTTP schemes.

Patch Information

No vendor patch is available at the time of publication. The maintainers of the projeto-siga project have been notified via GitHub Issue #2492 but have not yet responded. Monitor the upstream repository for a fix and apply it as soon as it is released.

Workarounds

Disable the HTML-to-PDF endpoint if it is not required for business operations.
Implement a URL allowlist at the proxy layer so DownloadExterno.getUrl can only reach approved external hosts.
Route all outbound requests from siga through an authenticated forward proxy that enforces destination policies and logs every request.
Apply Instance Metadata Service v2 (IMDSv2) session-token requirements on AWS to reduce impact if metadata is targeted.

bash

# Example iptables rules to block SSRF to internal ranges from the siga host
iptables -A OUTPUT -m owner --uid-owner siga -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner siga -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner siga -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner siga -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner siga -d 192.168.0.0/16 -j REJECT