CVE-2026-42870: WeGIA Stored XSS Vulnerability

CVE-2026-42870 Overview

CVE-2026-42870 is a Stored Cross-Site Scripting (XSS) vulnerability in WeGIA, an open-source web manager used by charitable institutions. The flaw exists in versions prior to 3.7.0 within the funcionario/profile_funcionario.php endpoint. Attackers can inject malicious JavaScript into the Descrição (Description) field of an employee profile. The payload persists in the application and executes whenever any user views the affected profile page. The issue is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation) and is fixed in WeGIA 3.7.0.

Critical Impact

Authenticated attackers can persistently store JavaScript that executes in the browser of any user viewing the targeted employee profile, enabling session theft, account takeover, and unauthorized actions within WeGIA.

Affected Products

• WeGIA web manager versions prior to 3.7.0
• Endpoint: funcionario/profile_funcionario.php
• Vulnerable field: Descrição (Description) in employee profile

Discovery Timeline

• 2026-05-11 - CVE-2026-42870 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42870

Vulnerability Analysis

The vulnerability is a Stored XSS issue in the employee profile management workflow of WeGIA. When an authenticated user saves an employee profile, the application accepts the Descrição field without performing sufficient output encoding or input sanitization. The submitted content is written to the backing database and later rendered inline when the profile is retrieved through profile_funcionario.php?id_funcionario=2.

Because the payload is persisted server-side, every subsequent request to the affected profile triggers execution in the victim's browser. This expands the blast radius beyond the original attacker and impacts administrators, managers, and other staff who legitimately view employee records. In a charitable institution context, viewers often hold elevated privileges, increasing the value of stolen sessions or coerced actions.

Root Cause

The root cause is missing contextual output encoding when rendering user-supplied profile data into HTML. The Descrição field is treated as trusted content rather than untrusted input. Standard defenses such as HTML entity encoding, Content Security Policy enforcement, and template auto-escaping were not applied to this code path before version 3.7.0.

Attack Vector

The attack vector is network-based and requires user interaction from a victim who navigates to the affected profile. An attacker with permission to edit an employee profile injects a JavaScript payload into the Description field and saves the profile. When a privileged user later opens that profile, the stored script runs with the victim's session context. Outcomes include cookie theft, CSRF-style operations against WeGIA APIs, and pivoting to administrative functions. Refer to the GitHub Security Advisory GHSA-q6jg-hfqv-882f for advisory details. No verified public exploit code is associated with this CVE.

Detection Methods for CVE-2026-42870

Indicators of Compromise

• Employee profile records whose Descrição field contains HTML tags such as <script>, <img onerror=...>, <svg onload=...>, or javascript: URIs.
• Unexpected outbound HTTP requests originating from browsers shortly after staff users access profile_funcionario.php.
• Web server access logs showing POST requests to the employee profile update endpoint followed by anomalous GET traffic to attacker-controlled domains.

Detection Strategies

• Run database queries against the employee profile table to identify rows where the description column contains angle brackets, event-handler attributes, or javascript: schemes.
• Inspect HTTP response bodies served from profile_funcionario.php for unescaped script content using a web application firewall or proxy.
• Correlate authenticated session activity with browser-side script execution anomalies, particularly requests not initiated by normal navigation.

Monitoring Recommendations

• Enable verbose access logging for all WeGIA profile management endpoints and retain logs for forensic review.
• Monitor for outbound connections from staff workstations to uncommon domains immediately following WeGIA usage.
• Alert on Content Security Policy violation reports if a CSP is deployed in front of the application.

How to Mitigate CVE-2026-42870

Immediate Actions Required

• Upgrade WeGIA to version 3.7.0 or later, which contains the official fix.
• Audit all existing employee profile records for previously injected payloads and sanitize affected entries.
• Rotate session tokens and credentials for users who may have viewed compromised profiles.
• Restrict edit permissions on employee profiles to the smallest necessary set of trusted users until patching is complete.

Patch Information

The maintainers of WeGIA addressed this vulnerability in release 3.7.0. Administrators should pull the patched release from the WeGIA GitHub repository and follow the project's upgrade documentation. Details of the fix are documented in the GitHub Security Advisory GHSA-q6jg-hfqv-882f.

Workarounds

• Deploy a web application firewall rule that blocks HTML and script tags in POST parameters submitted to profile_funcionario.php.
• Apply a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
• Temporarily disable employee profile editing for non-administrative roles until version 3.7.0 is installed.

# Configuration example: minimal CSP header to mitigate inline script execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"