This vulnerability is a server‑side request forgery (CWE‑918) that arises when an attacker manipulates the 'html' argument in the DownloadExterno.getUrl method of projeto‑siga's HTML‑to‑PDF endpoint. By sending a specially crafted request, the attacker can force the Siga server to fetch arbitrary URLs, potentially exposing internal resources, leaking sensitive data, or enabling further attacks against the infrastructure. The flaw is exploitable remotely through the documented endpoint and a public proof‑of‑concept has been released.

The affected product is projeto‑siga Siga version 11.1.1 and earlier. The flaw resides in the ExUtilController.java component within the sigaex module, which is responsible for converting HTML to PDF. Any deployment that exposes this endpoint without additional access controls is vulnerable.

The CVSS score of 6.9 indicates a medium severity, and no EPSS data is available, but the publicly available exploit and lack of an immediate fix raise the risk level. The vulnerability is considered unpatched; the project has not yet responded. Attackers can trigger SSRF by sending remote requests to the vulnerable endpoint, potentially reaching internal hosts if outbound filtering is absent. While the impact does not guarantee remote code execution, successful exploitation could lead to data disclosure, credential harvest, or internal network reconnaissance.