Remote Code Execution Vulnerability in WeGIA Web Manager for Charitable Institutions

CVE-2026-54670

What is CVE-2026-54670?

WeGIA, a web management tool for charitable organizations, is vulnerable due to improper handling of user inputs in its contribution request dispatcher. This allows an unauthenticated remote attacker to exploit the 'nomeClasse' and 'metodo' values, bypassing essential controller and method allowlists. Critical operations, such as accessing sensitive contribution records or invoking financial workflows, can be executed without authentication. Moreover, a specially crafted traversal name could lead to the inclusion of unauthorized PHP or configuration files, risking exposure of source code and sensitive credentials. Users are advised to upgrade to version 3.8.5 or later to mitigate this vulnerability.

References