CVE-2026-86273
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A weakness has been identified in projeto-siga siga up to 11.1.1. The function DownloadExterno.getUrl in the HTML-to-PDF Endpoint component is affected. Manipulation of the html argument causes server-side request forgery, which can be initiated remotely. The exploit has been made public.
Risk Assessment
The risk is the potential for remote exploitation to make unauthorized requests on behalf of the server, potentially leading to access to internal resources or privilege escalation.
Recommendation
It is recommended to immediately update siga to the latest version if available, and to implement SSRF protections such as URL validation and filtering.
Other vulnerabilities in projeto-siga siga
See all- CVE-2026-86274Medium
A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1 affecting the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java in the Authentication Flow component. Manipulation of the arguments cod/jwt leads to missing authorization. The attack may be launched remotely and the exploit is public. The project was informed but has not responded.
- CVE-2026-6990Low
A cross-site scripting vulnerability was found in projeto-siga siga version 11.0.3.18 in an unknown function of /sigawf/app/responsavel/novo. Manipulating the Nome/Descrição argument results in script injection. The attack can be initiated remotely and a public exploit is available.
Original NVD description (English source)
A weakness has been identified in projeto-siga siga up to 11.1.1. Affected by this issue is the function DownloadExterno.getUrl of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExUtilController.java of the component HTML-to-PDF Endpoint. This manipulation of the argument html causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS