WeGIA CVE-2026-42871

No special conditions are required to trigger the information disclosure - the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote unauthenticated exploitation against network-accessible instances of WeGIA prior to 3.7.0 with no prerequisite configuration. The specific endpoint is atendido/familiar_docfamiliar.php, which must be reachable over the network (e.g., not blocked by a WAF or firewall ACL). The exploitation is classified as automatable per SSVC, meaning no manual interaction per target is needed. Limiting factors: the impact is strictly informational (VC:L, no integrity or availability effect), meaning this vulnerability alone cannot be used to exfiltrate data, modify records, or gain system access - it requires chaining with a follow-on attack. Instances that are not network-exposed (e.g., internal-only deployments behind a VPN) face substantially reduced risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) confirms a fully remote, unauthenticated, low-complexity exploit path with limited confidentiality impact and no integrity or availability effect - placing this firmly in the 'medium severity, low urgency' tier for most defenders. EPSS of 0.04% at the 13th percentile reinforces that mass exploitation is unlikely in the near term. However, SSVC classification of Exploitation: poc and Automatable: yes is a non-trivial signal: automated scanners could trivially fingerprint vulnerable WeGIA instances at scale, and the existence of a PoC lowers the barrier for opportunistic attackers performing pre-attack reconnaissance. The vulnerability is not in CISA KEV, and technical impact is rated partial, consistent with the information-disclosure-only nature of the flaw. In practice, this is a genuine but lower-priority finding - critical to fix as part of normal patching cycles, but unlikely to warrant emergency response unless the WeGIA instance handles sensitive beneficiary data in a high-risk environment.

An unauthenticated remote attacker sends a crafted HTTP request to the publicly accessible atendido/familiar_docfamiliar.php endpoint designed to trigger an error condition - for example, supplying missing or malformed required parameters. The PHP application returns a verbose error response containing database-related details such as table names, query fragments, or driver information, which the attacker harvests to map the backend database schema. With this reconnaissance data, the attacker can craft more targeted SQL injection or authentication bypass attempts against other application endpoints. A proof-of-concept for triggering this disclosure is noted in SSVC data.