Server-Side Request Forgery in HTML-to-PDF Conversion Endpoint

A weakness has been identified in projeto-siga siga up to 11.1.1. Affected by this issue is the function DownloadExterno.getUrl of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExUtilController.java of the component HTML-to-PDF Endpoint. This manipulation of the argument html causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-86273 exposes a critical server-side request forgery (SSRF) vulnerability in projeto-siga's HTML-to-PDF conversion functionality. The flaw exists in the DownloadExterno.getUrl method, where unsanitized HTML input parameters allow attackers to manipulate the server into making arbitrary requests to internal or external resources. With a CVSS score of 7.3, this vulnerability affects siga versions up to 11.1.1 and poses significant risk to organizations using this document management system. Attackers can exploit this remotely without authentication, potentially accessing sensitive internal services, metadata endpoints, or cloud provider credentials—making it a high-priority remediation target for government and enterprise users of projeto-siga.

Casky.ai's 331 mapped skills identify this vulnerability through Claude's analysis of MITRE ATT&CK techniques TA0001 (Initial Access) and TA0006 (Credential Access). Practitioners using the platform will detect attack patterns including suspicious HTML parameter injection attempts, unusual outbound connections from the PDF endpoint, and requests targeting internal IP ranges or cloud metadata services (169.254.169.254, localhost interfaces). The extended reasoning capabilities flag the characteristic SSRF signature: POST requests to DownloadExterno endpoints with crafted HTML payloads containing file:// or http:// schemes pointing to sensitive resources. Security teams will observe these anomalies correlated against the specific vulnerable code path, enabling rapid identification and containment before attackers exfiltrate internal data or pivot further into the network.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-86273.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-86273

Casky has 331 skills that investigate the attack patterns behind CVE-2026-86273. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn