CVE-2026-31894

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-31894
WeGIA is a web manager for charitable institutions. In 3.6.5, The patched loadBackupDB() extracts tar.gz archives to a temporary directory using PHP's PharData class, then uses glob() and file_get_contents() to read SQL files from the extracted contents. Neither the extraction nor the file reading validates whether archive members are symbolic links. This vulnerability is fixed in 3.6.6.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/LabRedesCefetRJ/WeGIA/commit/79e7a164eddb527e3b331037b7a4defb8c115d50 Patch
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6mmm-27h8-8g55 Exploit Vendor Advisory Mitigation
Configurations

Configuration 1 (hide)

cpe:2.3:a:wegia:wegia:3.6.5:*:*:*:*:*:*:*
History

13 Mar 2026, 20:22

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CPE cpe:2.3:a:wegia:wegia:3.6.5:*:*:*:*:*:*:*
Summary
  • (es) WeGIA es un gestor web para instituciones benéficas. En 3.6.5, la función `loadBackupDB()` parcheada extrae archivos tar.gz a un directorio temporal utilizando la clase `PharData` de PHP, luego usa `glob()` y `file_get_contents()` para leer archivos SQL del contenido extraído. Ni la extracción ni la lectura de archivos validan si los miembros del archivo son enlaces simbólicos. Esta vulnerabilidad está corregida en 3.6.6.
First Time Wegia wegia
Wegia
References () https://github.com/LabRedesCefetRJ/WeGIA/commit/79e7a164eddb527e3b331037b7a4defb8c115d50 - () https://github.com/LabRedesCefetRJ/WeGIA/commit/79e7a164eddb527e3b331037b7a4defb8c115d50 - Patch
References () https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6mmm-27h8-8g55 - () https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6mmm-27h8-8g55 - Exploit, Vendor Advisory, Mitigation

11 Mar 2026, 20:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-11 20:16

Updated : 2026-03-13 20:22

NVD link : CVE-2026-31894

Mitre link : CVE-2026-31894

CVE.ORG link : CVE-2026-31894

JSON object : View

Products Affected

wegia

  • wegia
CWE
CWE-59

Improper Link Resolution Before File Access ('Link Following')