CVE-2026-31894: WeGIA affected by arbitrary file read via symlink in backup restore

Q: What is the severity of CVE-2026-31894?

CVE-2026-31894 has a high severity due to the potential for arbitrary file read via symlink.

Q: How do I fix CVE-2026-31894?

To fix CVE-2026-31894, upgrade WeGIA to version 3.6.6 or later.

Q: Who is affected by CVE-2026-31894?

Users of WeGIA versions prior to 3.6.6 are affected by CVE-2026-31894.

Q: What are the risks associated with CVE-2026-31894?

The risks include unauthorized access to sensitive files on the server due to symlink exploitation.

Q: What versions of WeGIA are vulnerable to CVE-2026-31894?

WeGIA versions up to 3.6.5 are vulnerable to CVE-2026-31894.

Published Mar 11, 2026

Updated

WeGIA is a web manager for charitable institutions. In 3.6.5, The patched loadBackupDB() extracts tar.gz archives to a temporary directory using PHP's PharData class, then uses glob() and filegetcontents() to read SQL files from the extracted contents. Neither the extraction nor the file reading validates whether archive members are symbolic links. This vulnerability is fixed in 3.6.6.

Affected Software

2 affected components

WeGIA WeGIA<3.6.6

WeGIA WeGIA=3.6.5

Remediation

Patch Available

https://github.com/LabRedesCefetRJ/WeGIA/commit/79e7a164eddb527e3b331037b7a4defb8c115d50

Event History

Mar 11, 2026

CVE Published

via MITRE·07:05 PM

Data Sourced

via MITRE·07:05 PM

DescriptionWeakness

Data Sourced

via NVD·08:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Jul 22, 58183

Event

via NVD·05:55 AM

Frequently Asked Questions

What is the severity of CVE-2026-31894?

CVE-2026-31894 has a high severity due to the potential for arbitrary file read via symlink.

How do I fix CVE-2026-31894?