Riskcovery

CVE-2026-55679

WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection

State
Published
Severity
6.5 Medium
Published
Oct 14, 2026
Updated
Oct 20, 2026
Reserved
Jun 17, 2026

Read the record on cve.org

Description

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command executed by shell_exec(). The installer also writes attacker-controlled values into executable config.php and concatenates the database name nomebd into a CREATE DATABASE statement. Successful exploitation can execute commands as the web-server user, persist attacker-controlled PHP configuration, and alter or disrupt the application and its data. This issue is fixed in version 3.8.6.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:LGitHub_M

Weaknesses

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
  • CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

ProductVersions
WeGIALabRedesCefetRJ
  • < 3.8.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.