CVE-2026-54670 in WeGIA
Summary
by MITRE • 09/18/2026
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive ContribuicaoLogController operations from authentication, and constructs a controller include path without canonical directory containment. An unauthenticated remote attacker can invoke getContribuicoesLogJSON, sincronizarStatus, registrarFaturas, and other sensitive methods to disclose contribution and donation records or trigger financial workflow operations. A traversal-shaped nomeClasse value can also cause require_once to include an accessible PHP or configuration file outside the intended controller directory, exposing source code, credentials, or other sensitive local data. This issue is fixed in version 3.8.5.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in WeGIA versions prior to 3.8.5 represents a critical failure in access control and input validation within the web application's contribution request dispatcher located at web/html/contribuicao/controller/control.php. This component serves as an entry point for handling financial workflows, specifically managing contributions and donations for charitable institutions. The core technical flaw stems from insufficient verification of user-supplied inputs, specifically the nomeClasse and metodo parameters. Instead of enforcing a strict allowlist that restricts execution to predefined, safe controller classes and methods, the application accepts arbitrary values provided by the attacker. This lack of validation allows an unauthenticated remote actor to manipulate the internal routing logic of the PHP framework, effectively bypassing intended security boundaries and gaining unauthorized access to sensitive administrative functions.
The operational impact of this vulnerability is severe due to two distinct attack vectors enabled by the flawed dispatcher. First, the application exempts specific operations within the ContribuicaoLogController from authentication requirements. By exploiting the lack of method allowlisting, an attacker can directly invoke methods such as getContribuicoesLogJSON, sincronizarStatus, and registrarFaturas without valid credentials. The disclosure of contribution logs via getContribuicoesLogJSON allows for the mass exfiltration of sensitive donor information, including names, contact details, donation amounts, and transaction histories. This data breach violates privacy regulations such as GDPR or local data protection laws and compromises the trust between the charitable institution and its donors. Furthermore, the ability to trigger financial workflow operations like registrarFaturas enables an attacker to manipulate billing records, potentially leading to fraudulent invoicing or disruption of legitimate financial processes.
Secondly, the vulnerability includes a path traversal component related to how the nomeClasse parameter is processed during controller inclusion. The application constructs a file system path for require_once based on this unsanitized input without implementing canonical directory containment checks. This oversight allows an attacker to use directory traversal sequences, such as ../, in the nomeClasse value to escape the intended controller directory and include arbitrary PHP files or configuration scripts located elsewhere on the server filesystem. Successful exploitation of this vector can lead to remote code execution if a writable file is included, but more commonly results in sensitive information disclosure. Attackers can expose source code containing hardcoded credentials, database connection strings, API keys, or other internal application logic that was never intended for public access. This aligns with CWE-284 Improper Access Control and CWE-22 Path Traversal: '..' Sequence, highlighting the dual nature of the flaw as both an authorization bypass and a file inclusion vulnerability.
From a threat intelligence perspective, this vulnerability maps to MITRE ATT&CK techniques involving Initial Access via Web Application Exploitation and Credential Access through Unsecured Credentials if configuration files are exposed. The exploitation chain typically involves reconnaissance followed by direct manipulation of application logic without authentication, which is characteristic of CWE-287 Improper Authentication. To mitigate these risks, organizations must immediately upgrade WeGIA to version 3.8.5 or later where the dispatcher has been hardened with strict allowlists for controllers and methods. In environments where immediate patching is not feasible, network-level controls such as Web Application Firewalls should be configured to block requests containing path traversal sequences in parameters named nomeClasse or metodo. Additionally, implementing a centralized authentication middleware that enforces access checks on all controller actions, regardless of their initial exemption status, would prevent unauthorized invocation of sensitive methods like getContribuicoesLogJSON. Regular security audits focusing on input validation and file inclusion logic are essential to maintain the integrity of financial data processing systems.