Directory Traversal Vulnerability in WeGIA Web Manager for Charitable Institutions
CVE-2026-31894

6.9MEDIUM

Key Information:

Vendor

Labredescefetrj

Status
Wegia
Vendor
CVE Published:
11 March 2026

What is CVE-2026-31894?

WeGIA, a web management tool designed for charitable institutions, contains a vulnerability in version 3.6.5 where the loadBackupDB() function extracts tar.gz archives into a temporary directory using PHP's PharData class. The method lacks sufficient validation on extracted archive members, particularly for symbolic links. This oversight allows for potential directory traversal attacks, which could lead to unauthorized access to sensitive files. The issue was resolved in version 3.6.6, ensuring that both extraction and file reading processes validate the integrity of archive contents.

Affected Version(s)

WeGIA >= 3.6.5, < 3.6.6

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisor...
x_refsource_CONFIRM
https://github.com/LabRedesCefetRJ/WeGIA/commit/79e7a164e...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.