CVE-2026-31894CWE-59

WeGIA affected by arbitrary file read via symlink in backup restore

Medium · published March 11, 2026

CVSS v4.0
6.9
EPSS
1%
Percentile
44.8
In the wild
Unconfirmed
What it is

WeGIA is a web manager for charitable institutions. In 3.6.5, The patched loadBackupDB() extracts tar.gz archives to a temporary directory using PHP's PharData class, then uses glob() and file_get_contents() to read SQL files from the extracted contents. Neither the extraction nor the file reading validates whether archive members are symbolic links. This vulnerability is fixed in 3.6.6.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00542 · 44.8th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-03-11T19:05Z
EPSS history
Timeline
  • 11 MAR 19:05Z
    WeGIA affected by arbitrary file read via symlink in backup restore
    cvelistv5