Command Execution Vulnerability in WeGIA Web Manager for Charitable Institutions

CVE-2026-55679

What is CVE-2026-55679?

WeGIA, a web management solution for charitable institutions, has a vulnerability that affects versions prior to 3.8.6. The issue originates from the pre-installation endpoint 'web/instalador/instalador.php,' which remains accessible before the 'config.php' file exists. This allows attackers to send unauthenticated POST data during installation processes. In particular, during the Linux reinstall flow, attackers can manipulate the 'usuario' value, leading to command execution via 'shell_exec()'. Additionally, the install process writes unvalidated data into the 'config.php' file, allowing manipulation of database creation statements. Exploitation of this flaw could result in arbitrary command execution under the web-server user context, potential persistence of malicious PHP configurations, and disruption of the application and its stored data. The issue was addressed in version 3.8.6.

References