CVE-2026-33133: WeGIA has an arbitrary SQL execution vulnerability via crafted backup archive

Q: What is the severity of CVE-2026-33133?

CVE-2026-33133 has a medium severity rating due to its potential for arbitrary SQL execution.

Q: How do I fix CVE-2026-33133?

To fix CVE-2026-33133, upgrade to WeGIA version 3.6.7 or later, which addresses the vulnerability.

Q: Which versions of WeGIA are affected by CVE-2026-33133?

CVE-2026-33133 affects WeGIA versions 3.6.5 and 3.6.6.

Q: What type of vulnerability is CVE-2026-33133?

CVE-2026-33133 is classified as an arbitrary SQL execution vulnerability.

Q: Can an attacker exploit CVE-2026-33133 remotely?

Yes, an attacker can exploit CVE-2026-33133 remotely by crafting a malicious backup archive.

Published Mar 20, 2026

Updated

WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB() function imports SQL files from uploaded backup archives without any content validation. An attacker can craft a backup archive containing arbitrary SQL statements that create rogue administrator accounts, modify existing passwords, or execute any database operation. This was introduced in commit 370104c. This issue was patched in version 3.6.7.

Affected Software

3 affected components

WeGIA WeGIA>=3.6.5<=3.6.6

WeGIA WeGIA=3.6.5

WeGIA WeGIA=3.6.6

Remediation

Patch Available

https://github.com/LabRedesCefetRJ/WeGIA/pull/1459

Event History

Mar 20, 2026

CVE Published

via MITRE·10:31 AM

Data Sourced

via MITRE·10:31 AM

DescriptionWeakness

Data Sourced

via NVD·11:18 AM

RemedyDescriptionSeverityWeaknessAffected Software

Jan 11, 58189

Event

via FIRST·05:28 PM

Frequently Asked Questions

What is the severity of CVE-2026-33133?

CVE-2026-33133 has a medium severity rating due to its potential for arbitrary SQL execution.

How do I fix CVE-2026-33133?