Executive brief
WeGIA is a web-based management platform used by charitable institutions to organize their operations. A security flaw allows an attacker to upload a specially named backup file that contains malicious code. If an administrator views or attempts to delete this file within the management interface, the code executes in their browser, potentially allowing the attacker to steal session cookies, take over administrative accounts, or perform unauthorized actions on behalf of the user.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in WeGIA versions prior to 3.6.9. The flaw is located in the backup management component, specifically within the 'importar_dump.php' script, which fails to properly sanitize filenames during the upload and listing process. An attacker can craft a malicious gzip backup file with a filename containing JavaScript payloads (e.g., using path traversal sequences and script tags). When an authenticated administrator interacts with the backup list—such as attempting to delete the malicious entry—the script executes in the context of their session. This can lead to session hijacking via cookie theft or unauthorized administrative actions. The issue is resolved in version 3.6.9.
Affected products
- LabRedesCefetRJ WeGIA < 3.6.9
Timeline
- 2026-04-02: advisory: GitHub Security Advisory published
- 2026-04-06: disclosed: CVE published to NVD
- 2026-04-06: patched: Fix released in version 3.6.9