Which versions of Wegia are affected by CVE-2026-35399?

WeGIA Web Manager for charitable institutions contains a stored cross-site scripting vulnerability (CVE-2026-35399, CVSS 8.5) that allows unauthenticated remote attackers to inject malicious scripts…. A patch is available.

How to fix or mitigate CVE-2026-35399?

Within 24 hours: identify all WeGIA Web Manager installations and their current versions. Within 7 days: upgrade all instances to version 3.6.9 or later per vendor advisory, and audit backup filename logs for suspicious entries. Within 30 days: conduct a security review of user sessions created during the vulnerability window and implement content security policy (CSP) headers to mitigate XSS attack surface.

Wegia CVE-2026-35399

Q: What is the CVSS score of CVE-2026-35399?

CVE-2026-35399 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-19500 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-06 security-advisories@github.com

XSS Wegia

8.5

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:05 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.6.9

EUVD ID Assigned

Apr 06, 2026 - 21:22 euvd

EUVD-2026-19500

Analysis Generated

Apr 06, 2026 - 21:22 vuln.today

CVE Published

Apr 06, 2026 - 21:16 nvd

HIGH 8.5

DescriptionGitHub Advisory

WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, a stored XSS vulnerability allows an attacker to inject malicious scripts through a backup filename. This could lead to unauthorized execution of malicious code in the victim's browser, compromising session data or executing actions on behalf of the user. This vulnerability is fixed in 3.6.9.

AnalysisAI

Stored cross-site scripting (XSS) in WeGIA Web manager for charitable institutions allows remote attackers to inject malicious scripts via specially crafted backup filenames, leading to session hijacking or unauthorized actions performed in victim browsers. Affects versions prior to 3.6.9. No public exploit identified at time of analysis, though CVSS 8.5 reflects high impact to confidentiality and integrity with low attack complexity and no authentication requirements.

Technical ContextAI

WeGIA is a web-based management application designed for charitable institutions. This vulnerability stems from improper neutralization of input during web page generation (CWE-79), specifically in the backup filename handling mechanism. Unlike reflected XSS, stored XSS persists the malicious payload in the application's backend (likely a file system or database storing backup metadata), causing the script to execute whenever the poisoned filename is rendered in an administrator or user's browser. The CVSS 4.0 vector indicates network-based attack vector (AV:N) with low complexity (AC:L) and no privileges required (PR:N), though user interaction is necessary (UI:A), suggesting the victim must access a page displaying the malicious filename. The vulnerability affects WeGIA versions before 3.6.9, with the GitHub Security Advisory GHSA-fmwv-62wf-2hgx serving as the authoritative disclosure source.

RemediationAI

Vendor-released patch: Upgrade WeGIA to version 3.6.9 or later, which contains fixes for the backup filename XSS vulnerability. The patch likely implements proper input validation and output encoding for backup filename fields to prevent script injection. Organizations should obtain the patched version from the official WeGIA GitHub repository at https://github.com/LabRedesCefetRJ/WeGIA and follow standard change management procedures for web application updates, including testing in non-production environments before deployment. As an interim mitigation until patching is complete, administrators should restrict access to backup management interfaces to trusted users only, implement Content Security Policy (CSP) headers to limit script execution sources, and educate users not to click on suspicious backup filename entries. Full remediation guidance is available in the GitHub Security Advisory at https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-fmwv-62wf-2hgx.