CVE-2026-55679CWE-78CWE-89CWE-94command-injectionsql-injectioncode-injection

CVE-2026-55679

Medium · published October 15, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command executed by shell_exec(). The installer also writes attacker-controlled values into executable config.php and concatenates the database name nomebd into a CREATE DATABASE statement. Successful exploitation can execute commands as the web-server user, persist attacker-controlled PHP configuration, and alter or disrupt the application and its data. This issue is fixed in version 3.8.6.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00428 · 36.0th percentile
Weaknesses
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-10-15T00:17Z
References (6)
https://github.com/LabRedesCefetRJ/WeGIA/commit/b13c4b0b416d99a8145f583e0893bc8172155469 · [email protected]https://github.com/LabRedesCefetRJ/WeGIA/issues/96 · [email protected]https://github.com/LabRedesCefetRJ/WeGIA/pull/1705 · [email protected]https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6 · [email protected]https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-wm6j-4rfm-399q · [email protected]https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-wm6j-4rfm-399q · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 16 OCT 03:31Z
    EPSS moved — → 0%
    epss
  • 14 OCT 19:44Z
    WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection
    cvelistv5
  • 14 OCT 19:44Z
    WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection
    cvelistv5