Is there a patch available for CVE-2026-42873?

Yes, a patch is available for CVE-2026-42873. Update the affected software to the latest version immediately.

WeGIA CVE-2026-42873

EUVD-2026-29188 NONE

Information Exposure (CWE-200)

2026-05-11 GitHub_M

PHP Information Disclosure Wegia

Severity by source

GitHub Advisory

0.0 LOW

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 11, 2026 - 20:02 EUVD

Analysis Generated

May 11, 2026 - 19:47 vuln.today

CVE Published

May 11, 2026 - 18:34 nvd

NONE

DescriptionGitHub Advisory

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, when attempting to upload a file with malicious content to funcionario/docdependente_upload.php, the application responds with an overly descriptive error message. This leads to information disclosure, effectively increasing the attack surface by providing potential attackers with technical insights to refine their exploits. This vulnerability is fixed in 3.6.10.

AnalysisAI

Information disclosure in WeGIA versions prior to 3.6.10 allows authenticated remote attackers to obtain sensitive technical details through overly descriptive error messages in the file upload endpoint (funcionario/docdependente_upload.php), expanding the attack surface for subsequent exploitation attempts.

Technical ContextAI

WeGIA is a PHP-based web application for managing charitable institutions. The vulnerability exists in the file upload handler at funcionario/docdependente_upload.php, which processes document uploads. When file validation fails (e.g., malicious content detection), the application returns verbose error messages that leak internal implementation details, stack traces, or system configuration information. This violates CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) by providing attackers reconnaissance data without proper error handling. The issue affects all versions of the cpe:2.3:a:labredescefetrj:wegia product line prior to 3.6.10.

RemediationAI

Upgrade WeGIA to version 3.6.10 or later immediately. This is the vendor-released patch confirmed in the GitHub security advisory (GHSA-mwc9-45h6-pw24). No interim workarounds are documented. Administrators should prioritize this upgrade despite the low severity classification, as information disclosure vulnerabilities are foundational to multi-stage attacks. Verify the upgrade by checking the application version in configuration files or the administrative dashboard. If immediate upgrading is not feasible, restrict network access to the /funcionario/docdependente_upload.php endpoint to trusted IP ranges or disable the document upload feature temporarily, though these measures degrade functionality and do not eliminate the disclosure risk.