Pre-auth installer injection in WeGIA enables command execution
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution, SQL injection
- Confidentiality · integrity · availability
- None · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78 and CWE-89.
Summary
WeGIA from LabRedesCefetRJ before 3.8.6 exposes its installer endpoint before configuration exists. Unauthenticated POST data reaches a shell command through a crafted usuario value in the Linux reinstall flow. The installer also writes attacker values into executable config.php. An unauthenticated remote attacker can run commands as the web-server user and alter the application and its data.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command executed by shell_exec(). The installer also writes attacker-controlled values into executable config.php and concatenates the database name nomebd into a CREATE DATABASE statement. Successful exploitation can execute commands as the web-server user, persist attacker-controlled PHP configuration, and alter or disrupt the application and its data. This issue is fixed in version 3.8.6.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| LabRedesCefetRJ | WeGIA | before 3.8.6 | 3.8.6 | Patch available | CNA |
- WeGIA VendorLabRedesCefetRJ Affected before 3.8.6 Fixed in 3.8.6 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:* | — | — | LabRedesCefetRJ |
- cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:* Versions — — ·LabRedesCefetRJ
Remediation
Upgrade WeGIA to version 3.8.6, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA WeGIA (LabRedesCefetRJ) Fixed in 3.8.6
Timeline
- 2026-10-15 Threatist record created from CVE-2026-55679
- 2026-10-16 Priority changed: MEDIUM → LOW
- 2026-10-20 CISA SSVC decision points changed
- 2026-10-20 Priority changed: LOW → MEDIUM
References
Other 5
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-wm6j-4rfm-399q
- https://github.com/LabRedesCefetRJ/WeGIA/issues/96
- https://github.com/LabRedesCefetRJ/WeGIA/pull/1705
- https://github.com/LabRedesCefetRJ/WeGIA/commit/b13c4b0b416d99a8145f583e0893bc8172155469
- https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6
More LabRedesCefetRJ vulnerabilities
- TI-2026-74469 SQL injection in WeGIA lets remote attackers read and modify data CVSS 3.1CRITICAL 9.8
- TI-2026-24448 WeGIA has a Time-Based Blind SQL Injection in remover_produto_ocultar.php CVSS 3.1CRITICAL 9.8
- TI-2026-22685 WeGIA Vulnerable to Authentication Bypass via `extract($_REQUEST)` CVSS 3.1CRITICAL 9.8
- TI-2026-22683 WeGIA Vulnerable to Remote Code Execution (RCE) via OS Command Injection CVSS 3.1CRITICAL 10.0
- TI-2026-22682 WeGIA lacks authentication verification in adicionar_tipo_docs_atendido.php CVSS 3.1CRITICAL 9.8
- TI-2025-38628 WeGIA SQL Injection via 'id_dependente' param at endpoint `/html/funcionario/dependente_documento.php` CVSS 4.0CRITICAL 9.4
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences