WeGIA CVE-2026-54670

No special conditions - remote unauthenticated exploitation against default configurations of WeGIA prior to 3.8.5, reachable at web/html/contribuicao/controller/control.php. The pre-patch dispatcher hardcoded an auth exemption for ContribuicaoLogController and lacked a controller/method allowlist, so no session or credentials are required to invoke sensitive methods. The path-traversal LFI variant is additionally limited to files that already exist and are readable and resolve with a .php suffix, since the include path is constructed as controller name plus .php. Exploitation only requires network HTTP access to the application; there is no user-interaction or non-default-configuration requirement.

This is a genuine high-priority issue. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) is well-supported by the description and the confirmed patch diff: control.php accepted attacker-supplied nomeClasse/metodo with no complete controller+method allowlist and explicitly exempted ContribuicaoLogController from the session check, so an unauthenticated remote attacker can reach sensitive dispatcher methods over the network with low complexity. C:H and I:H are both justified - confidentiality from disclosure of contribution/donation records and, via the traversal-shaped require_once include, of source code, credentials, or config files; integrity from unauthenticated invocation of financial workflow operations (sincronizarStatus, registrarFaturas). A:N is reasonable. No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the priority rests on the low attack bar and unauthenticated network reach, not on observed weaponization. The two published fix commits and the 3.8.5 release tag confirm a patch is available. Note the require_once path builds $controller . '.php', so a traversal payload must resolve to an existing readable .php file; this bounds the LFI to already-present files rather than arbitrary content, though included PHP is executed.

An unauthenticated attacker sends a crafted HTTP request (JSON body or form parameters) to web/html/contribuicao/controller/control.php setting nomeClasse=ContribuicaoLogController and metodo=getContribuicoesLogJSON to dump contribution and donation records, or metodo=registrarFaturas/sincronizarStatus to drive financial workflows without a session. Alternatively a traversal-shaped nomeClasse causes require_once to include an accessible PHP/config file outside the controller directory, exposing source or credentials. No public exploit code is identified, but the patched dispatcher logic makes the payload structure obvious.