CVE-2026-55679

Deferred Deferred - Pending Action

WeGIA Pre-Installation Command Injection Vulnerability

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command executed by shell_exec(). The installer also writes attacker-controlled values into executable config.php and concatenates the database name nomebd into a CREATE DATABASE statement. Successful exploitation can execute commands as the web-server user, persist attacker-controlled PHP configuration, and alter or disrupt the application and its data. This issue is fixed in version 3.8.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-55679

EUVD

EUVD-2026-101621

Affected Vendors & Products

Vendor	Product	Version / Range
LabRedesCefetRJ	WeGIA	< 3.8.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-89	The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-55679 is a pre-authentication installer injection vulnerability in WeGIA versions 3.8.5 and earlier. The installer endpoint (web/instalador/instalador.php) is accessible before config.php exists and processes unauthenticated POST data unsafely. Attackers can exploit this to execute OS commands via shell_exec() using crafted inputs, inject arbitrary PHP code into config.php via fwrite(), and manipulate SQL queries by directly concatenating database names into CREATE DATABASE statements. This leads to full host compromise as the web server user.

Detection Guidance

Check if the WeGIA installer endpoint is accessible at web/instalador/instalador.php without authentication. Inspect POST requests to this endpoint for unsanitized inputs like 'usuario' that could trigger command injection. Review config.php for unexpected PHP code changes or malicious entries.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on your server as the web server user, modify or delete application data, and persist malicious PHP code in config.php. It can lead to full compromise of the application, its data, and potentially the underlying host system. Attackers could steal sensitive information, deface the application, or use it as a foothold for further attacks.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires protection of personal data (Article 32) and breach notification (Article 33). HIPAA mandates safeguards for protected health information (45 CFR §164.308). Exploitation could result in unauthorized data access, requiring breach notifications and potential fines for non-compliance.

Mitigation Strategies

Upgrade WeGIA to version 3.8.6 or later immediately. If upgrading is not possible, restrict access to the installer endpoint via web server rules and ensure config.php is not writable by the web server user. Disable the installer endpoint if not needed.

Hi! I’m here to help you understand CVE-2026-55679. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70