CVE-2026-42873: WeGIA: Error Handling Upload DocDependente

Severity: none (CVSS 0.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-11 · updated 2026-10-26
Weakness: CWE-200

Description

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, when attempting to upload a file with malicious content to funcionario/docdependente_upload.php, the application responds with an overly descriptive error message. This leads to information disclosure, effectively increasing the attack surface by providing potential attackers with technical insights to refine their exploits. This vulnerability is fixed in 3.6.10.

Affected products

LabRedesCefetRJ WeGIA: before 3.6.10

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mwc9-45h6-pw24
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mwc9-45h6-pw24

Get alerted when CVE-2026-42873 or the next vulnerability affects your stack