Vulnerability · Published Mar 11, 2026 · Assigned by GitHub_M

CVE-2026-31894WeGIA affected by arbitrary file read via symlink in backup restore

Medium 6.9

In plain English

A medium-severity security flaw in WeGIA from LabRedesCefetRJ. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.5%top 58.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

WeGIA is a web manager for charitable institutions. In 3.6.5, The patched loadBackupDB() extracts tar.gz archives to a temporary directory using PHP's PharData class, then uses glob() and file_get_contents() to read SQL files from the extracted contents. Neither the extraction nor the file reading validates whether archive members are symbolic links. This vulnerability is fixed in 3.6.6.

Affected products (as reported)

Vendor	Product	Versions
LabRedesCefetRJ	WeGIA	>= 3.6.5, < 3.6.6

Weakness: CWE-59 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6mmm-27h8-8g55 x_refsource_CONFIRM
https://github.com/LabRedesCefetRJ/WeGIA/commit/79e7a164eddb527e3b331037b7a4defb8c115d50 x_refsource_MISC