CVE-2026-31894
Published: 11 March 2026
Summary
CVE-2026-31894 is a medium-severity Link Following (CWE-59) vulnerability in Wegia Wegia. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-31894 is a file access vulnerability (CWE-59: Improper Link Resolution Before File Access) affecting WeGIA version 3.6.5, an open-source web manager for charitable institutions. The issue resides in the loadBackupDB() function, which processes uploaded tar.gz backup archives by extracting them to a temporary directory using PHP's PharData class. It then employs glob() and file_get_contents() to read SQL files from the extracted contents. Critically, neither the extraction process nor the file reading operations validate whether archive members are symbolic links, enabling potential symlink following to unintended files. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and was published on 2026-03-11.
An unauthenticated remote attacker can exploit this vulnerability by supplying a malicious tar.gz archive via the backup restoration feature. During extraction, symlinks within the archive can point to arbitrary files on the server, such as sensitive configuration files or database contents. When the application subsequently reads files matching the glob pattern, it follows these symlinks, resulting in unauthorized disclosure of the targeted files' contents to the attacker. This achieves high confidentiality impact without requiring privileges, user interaction, or altering system integrity or availability.
The WeGIA GitHub security advisory (GHSA-6mmm-27h8-8g55) and the fixing commit (79e7a164eddb527e3b331037b7a4defb8c115d50) confirm the issue was resolved in version 3.6.6. Practitioners should advise upgrading to 3.6.6 or later, where proper symlink validation is implemented during extraction and file handling. No additional workarounds are detailed in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11309
Vulnerability details
WeGIA is a web manager for charitable institutions. In 3.6.5, The patched loadBackupDB() extracts tar.gz archives to a temporary directory using PHP's PharData class, then uses glob() and file_get_contents() to read SQL files from the extracted contents. Neither the extraction…
more
nor the file reading validates whether archive members are symbolic links. This vulnerability is fixed in 3.6.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables unauthenticated remote exploitation of public-facing web app (backup restore) for arbitrary local file read via symlink following during PharData extraction and glob/file_get_contents, directly mapping to T1190 for initial access and T1005 for resulting data collection from local system files/configs.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of uploaded tar.gz archives during extraction to block symlinks that enable unauthorized disclosure of arbitrary server files.
Mandates timely remediation of the specific flaw in loadBackupDB() by patching to version 3.6.6, which implements symlink validation.
Enforces least privilege on the web application process to restrict access to sensitive files even if symlinks are followed during extraction.