CVE-2026-31894: WeGIA Path Traversal Vulnerability

CVE-2026-31894 Overview

CVE-2026-31894 is a symlink attack vulnerability affecting WeGIA, a web manager for charitable institutions. The vulnerability exists in the loadBackupDB() function in version 3.6.5, which extracts tar.gz archives to a temporary directory using PHP's PharData class. The function then uses glob() and file_get_contents() to read SQL files from the extracted contents. Neither the extraction nor the file reading operations validate whether archive members are symbolic links, allowing an attacker to craft a malicious backup archive containing symlinks that point to sensitive files outside the intended directory.

Critical Impact

An authenticated attacker with high privileges can exploit this symlink vulnerability to read arbitrary files from the server's filesystem by crafting a malicious backup archive containing symbolic links, potentially exposing sensitive configuration files, credentials, and other confidential data.

Affected Products

• WeGIA version 3.6.5
• WeGIA web manager for charitable institutions (versions prior to 3.6.6)

Discovery Timeline

• 2026-03-11 - CVE CVE-2026-31894 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-31894

Vulnerability Analysis

This vulnerability falls under CWE-59 (Improper Link Resolution Before File Access), commonly known as a symlink attack. The loadBackupDB() function in WeGIA's backup restoration functionality accepts tar.gz archive files and extracts them without verifying the nature of the archived files. When a malicious archive contains symbolic links pointing to files outside the temporary extraction directory, the subsequent glob() and file_get_contents() operations follow these symlinks and read the target files.

The attack requires network access and high privileges (administrative access to the backup restoration feature). However, once exploited, it allows complete confidentiality breach where an attacker can read arbitrary files readable by the web server process, including configuration files containing database credentials, API keys, and other sensitive information.

Root Cause

The root cause is the absence of symlink validation during both the archive extraction phase and the subsequent file reading operations. PHP's PharData class extracts archive contents including symbolic links without any warning or validation. The code then blindly follows these symlinks when reading SQL files using file_get_contents(), resulting in arbitrary file read capabilities.

Attack Vector

The attack vector is network-based and requires the attacker to have administrative privileges to access the backup restoration functionality. The attack flow involves:

1. Creating a malicious tar.gz archive containing a symbolic link (e.g., backup.sql -> /etc/passwd)
2. Uploading this archive through the backup restoration interface
3. The loadBackupDB() function extracts the archive, including the symlink
4. When the function reads the SQL files via glob() and file_get_contents(), it follows the symlink
5. The contents of the target file (e.g., /etc/passwd) are read instead of legitimate backup data

The security patch addresses this by using realpath() to resolve the temporary directory path and validate that extracted files remain within the intended extraction directory:

         throw new RuntimeException('Falha ao criar diretório temporário.');
     }
 
+    $tmpDirReal = realpath($tmpDir);
+    if ($tmpDirReal === false) {
+        throw new RuntimeException('Falha ao resolver diretório temporário.');
+    }
+
     try {
         // 4. Copia backup para /tmp
         $tmpGz = $tmpDir . '/backup.tar.gz';

Source: GitHub Commit Details

Detection Methods for CVE-2026-31894

Indicators of Compromise

• Backup archive files containing symbolic links uploaded to the WeGIA application
• Unusual file access patterns in web server logs showing access to system files during backup restoration operations
• Error logs showing attempts to read files outside the application directory structure
• Unexpected read operations on sensitive files like /etc/passwd, /etc/shadow, or application configuration files

Detection Strategies

• Monitor file system access for symlink traversal attempts during archive extraction operations
• Implement file integrity monitoring on sensitive configuration files to detect unauthorized read access
• Review web application logs for backup restoration requests with unusually large response sizes or errors
• Deploy web application firewall rules to inspect uploaded archive contents for symbolic links

Monitoring Recommendations

• Enable detailed logging for the backup restoration functionality in WeGIA
• Monitor for PHP warnings or errors related to file_get_contents() accessing unexpected paths
• Implement audit logging for all administrative actions in the WeGIA application
• Use endpoint detection tools to monitor for suspicious file access patterns by the web server process

How to Mitigate CVE-2026-31894

Immediate Actions Required

• Upgrade WeGIA to version 3.6.6 or later immediately
• Restrict access to the backup restoration functionality to only essential administrative personnel
• Review recent backup restoration operations for signs of exploitation
• Audit system logs for any unauthorized file access during the vulnerable period

Patch Information

The vulnerability is fixed in WeGIA version 3.6.6. The patch, available in commit 79e7a164eddb527e3b331037b7a4defb8c115d50, implements proper path validation using realpath() to ensure extracted files cannot escape the temporary directory through symbolic links. Organizations should apply this update immediately by following the standard WeGIA upgrade procedures. For additional details, refer to the GitHub Security Advisory GHSA-6mmm-27h8-8g55.

Workarounds

• Temporarily disable the backup restoration feature until the patch can be applied
• Implement network-level restrictions to limit access to administrative interfaces
• Use a web application firewall to block upload of tar.gz files containing symbolic links
• Run the web server under a restricted user account with minimal file system permissions

# Restrict file permissions on sensitive files as a defense-in-depth measure
chmod 600 /var/www/wegia/config/*.php
chown www-data:www-data /var/www/wegia/config/*.php

# Verify WeGIA version after upgrade
grep -r "version" /var/www/wegia/includes/version.php