CVE-2026-33133: WeGIA has an arbitrary SQL execution vulnerability via crafted backup archive

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-20 · updated 2026-06-17
Weakness: CWE-89

Description

WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB() function imports SQL files from uploaded backup archives without any content validation. An attacker can craft a backup archive containing arbitrary SQL statements that create rogue administrator accounts, modify existing passwords, or execute any database operation. This was introduced in commit 370104c. This issue was patched in version 3.6.7.

Affected products

LabRedesCefetRJ WeGIA: 3.6.5, 3.6.6

References

https://github.com/LabRedesCefetRJ/WeGIA/pull/1459
https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.7
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qqff-p8fc-hg5f

Get alerted when CVE-2026-33133 or the next vulnerability affects your stack