CVE-2026-28409

CVE-2026-28409 is a critical remote code execution (RCE) vulnerability with a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) affecting WeGIA, an open-source web manager for charitable institutions. The flaw, tied to CWE-78 (OS Command Injection), resides in the application's database restoration functionality prior to version 3.6.5. It allows attackers to execute arbitrary operating system commands on the server by uploading a backup file with a specially crafted filename.

An attacker requires administrative access to exploit this vulnerability, which can be obtained through a previously reported authentication bypass vulnerability. Once authenticated as an admin, the attacker can leverage the database restoration feature to inject and execute OS commands remotely over the network with low complexity and no user interaction required. Successful exploitation grants full control over the server, enabling high-impact confidentiality, integrity, and availability compromises due to the changed scope.

The GitHub Security Advisory (GHSA-5m5g-q2vv-rv3r) confirms that WeGIA version 3.6.5 addresses and fixes the issue. Security practitioners should immediately upgrade to version 3.6.5 or later and review access controls, particularly around administrative privileges and backup restoration features, while monitoring for related authentication bypass vulnerabilities.