CVE-2026-35475: WeGIA - Open Redirect - backup redirection — Unvalidated $_GET['redirect']
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, the redirect parameter is taken directly from $GET with no URL validation or whitelist check, then used verbatim in a header("Location: ...") call. This vulnerability is fixed in 3.6.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.6.9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35475?
The severity of CVE-2026-35475 is considered to be medium due to potential unauthorized redirection risks.
How do I fix CVE-2026-35475?
To fix CVE-2026-35475, update WeGIA to version 3.6.9 or later, where the redirect parameter is properly validated.
What are the risks associated with CVE-2026-35475?
The risks associated with CVE-2026-35475 include phishing attacks and redirecting users to malicious websites.
Which versions of WeGIA are affected by CVE-2026-35475?
Versions of WeGIA prior to 3.6.9 are affected by CVE-2026-35475 due to unvalidated redirect parameters.
What is the nature of the vulnerability described in CVE-2026-35475?
CVE-2026-35475 describes an open redirect vulnerability caused by the lack of validation on the $_GET['redirect'] parameter.