WeGIA CVE-2026-42873

Exploitation requires authenticated access to the application (PR:L per CVSS vector), meaning the attacker must first obtain valid login credentials or compromise an existing user account. The vulnerable endpoint /funcionario/docdependente_upload.php must be accessible via the network without further privilege escalation. Default or standard configurations are susceptible; no special non-default configuration is required to trigger the information disclosure. The vulnerability is triggered by any file upload attempt that fails validation, making it easily reproducible once authenticated. Limitation: unauthenticated remote users cannot directly trigger the disclosure, significantly reducing attack surface compared to network-accessible information leaks.

CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N) indicates network-accessible remote attack with low complexity requiring authenticated login, no user interaction, and limited scope with confidentiality impact only. However, the confidentiality rating (C:N) in the vector appears inconsistent with the information disclosure description-the technical context clearly establishes sensitive information exposure. This likely reflects CVSS's narrow focus on direct impact rather than reconnaissance value. The lack of assigned CVSS score (despite a valid vector) and absence of EPSS data suggests this is a lower-severity, non-critical issue. No KEV listing or public exploit code reported. Real-world risk is moderate: exploitation requires authenticated access (limiting scope to users or attackers with valid credentials), but the information disclosure directly enables refinement of secondary attacks. This is a classic reconnaissance-enabling vulnerability with asymmetric value-minimal direct impact but measurable increase in attack surface for follow-up exploitation.

An authenticated user or attacker with valid credentials (via credential compromise or social engineering) attempts to upload a crafted malicious file to funcionario/docdependente_upload.php. The server's validation routine rejects the file and responds with a detailed error message exposing the file type validation logic, file size limits, backend framework/version, or database schema hints. The attacker uses this reconnaissance data to craft a subsequent payload bypassing the observed validation rules, potentially escalating to file upload leading to remote code execution in a follow-up attack.