CVE-2026-42873: WeGIA Information Disclosure Vulnerability

CVE-2026-42873 Overview

CVE-2026-42873 is an information disclosure vulnerability in WeGIA, an open-source web manager for charitable institutions developed by LabRedesCefetRJ. The flaw affects versions prior to 3.6.10. When a user uploads a file with malicious content to the funcionario/docdependente_upload.php endpoint, the application returns an overly descriptive error message. The response reveals internal technical details that attackers can use to refine subsequent exploitation attempts. The issue is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor) and is fixed in version 3.6.10.

Critical Impact

Authenticated attackers can extract internal application details through verbose error responses, expanding the attack surface for follow-on attacks against the document upload workflow.

Affected Products

• WeGIA versions prior to 3.6.10
• Affected endpoint: funcionario/docdependente_upload.php
• Maintainer: LabRedesCefetRJ

Discovery Timeline

• 2026-05-11 - CVE-2026-42873 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42873

Vulnerability Analysis

The vulnerability resides in the dependent-document upload handler at funcionario/docdependente_upload.php. When the application processes an uploaded file and rejects it due to malicious or unexpected content, it returns an error message that contains internal implementation details rather than a generic failure response. These details may include file paths, function names, library versions, or stack-style diagnostics intended for developers.

The attack requires low privileges and no user interaction. An authenticated user with access to the upload functionality can iterate file payloads and observe how the application responds. Each verbose error refines the attacker's understanding of server-side validation logic, storage layout, and the underlying technology stack. While the flaw alone does not compromise confidentiality, integrity, or availability of stored data, it lowers the cost of identifying chained vulnerabilities such as path traversal, code execution through file upload, or insecure deserialization.

Root Cause

The root cause is improper error handling in the file upload routine. The application surfaces raw diagnostic output to the client instead of returning a sanitized, generic error message and logging detailed information server-side.

Attack Vector

The attack vector is network-based over HTTP. An authenticated attacker submits crafted file uploads to funcionario/docdependente_upload.php and parses the returned error responses. No specialized tooling is required. See the GitHub Security Advisory for vendor technical details.

Detection Methods for CVE-2026-42873

Indicators of Compromise

• Repeated POST requests to funcionario/docdependente_upload.php from a single authenticated session within a short time window.
• HTTP responses from the upload endpoint containing stack traces, absolute file paths, or PHP function names.
• Upload attempts with unusual file extensions, MIME mismatches, or embedded scripting payloads (e.g., .php, .phtml, polyglot files).

Detection Strategies

• Inspect web server access logs for high-volume upload requests targeting the dependent-document endpoint.
• Apply web application firewall (WAF) rules that flag outbound responses containing diagnostic strings such as Fatal error, Stack trace, or filesystem path patterns.
• Correlate authenticated user sessions with repeated upload failures returning non-generic error bodies.

Monitoring Recommendations

• Enable verbose application logging server-side while suppressing diagnostic output in HTTP responses, and forward logs to a centralized SIEM.
• Monitor the EPSS score for CVE-2026-42873, which currently sits at 0.032%, to track changes in exploitation likelihood.
• Track all file uploads against expected MIME types and file size baselines for the WeGIA application.

How to Mitigate CVE-2026-42873

Immediate Actions Required

• Upgrade WeGIA to version 3.6.10 or later, which contains the official fix.
• Restrict access to funcionario/docdependente_upload.php to only the user roles that require document upload functionality.
• Review recent application and web server logs for prior exploitation attempts against the upload endpoint.

Patch Information

The vulnerability is patched in WeGIA 3.6.10. The fix changes the error handling in the upload workflow so that internal diagnostic details are no longer returned to the client. Refer to the GitHub Security Advisory GHSA-mwc9-45h6-pw24 for upgrade instructions.

Workarounds

• Disable PHP display_errors in production and route diagnostics to a server-side log file via error_log.
• Place WeGIA behind a reverse proxy or WAF that strips diagnostic content from outbound HTTP responses.
• Temporarily restrict the upload endpoint via network ACLs to trusted internal users until the patch is applied.

# Configuration example: suppress verbose PHP errors in production
# /etc/php/php.ini
display_errors = Off
display_startup_errors = Off
log_errors = On
error_log = /var/log/php/error.log
error_reporting = E_ALL