CVE-2026-55679: WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command executed by shellexec(). The installer also writes attacker-controlled values into executable config.php and concatenates the database name nomebd into a CREATE DATABASE statement. Successful exploitation can execute commands as the web-server user, persist attacker-controlled PHP configuration, and alter or disrupt the application and its data. This issue is fixed in version 3.8.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.8.6
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
WeGIA installations prior to 3.8.6 are exposed when the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists. The described command-execution path applies to the Linux reinstall flow.
What access does an attacker need?
No authentication or user interaction is required. An attacker needs network access to submit crafted installation POST data to the reachable installer endpoint.
What is the impact if exploitation succeeds?
An attacker can execute commands as the web-server user, inject attacker-controlled PHP into config.php for persistence, and alter or disrupt the application and its data through the database-related injection path.
What version resolves the issue?
Upgrade WeGIA to version 3.8.6, which fixes this issue.