CVE-2026-35396 LabRedesCefetRJ CVE debrief

Who should care

Administrators and users of WeGIA version prior to 3.6.9 should be aware of this vulnerability and take necessary actions to upgrade to the latest version. This includes IT personnel responsible for maintaining WeGIA installations, security teams monitoring for potential threats, and end-users who may be affected by the vulnerability. Operators of charitable institutions using WeGIA should prioritize upgrading to version 3.6.9 or later to mitigate the risk of exploitation.

Technical summary

The Open Redirect vulnerability in WeGIA allows attackers to redirect users to arbitrary external websites by manipulating the nextPage parameter in the /WeGIA/controle/control.php endpoint. This can lead to phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. The vulnerability exists due to insufficient validation of the nextPage parameter when combined with metodo=listarId and nomeClasse=IsaidaControle. To exploit this, attackers can craft a malicious URL that redirects users to an external site, potentially leading to sensitive information disclosure or further malicious activities.

Defensive priority

Medium

Recommended defensive actions

• Upgrade WeGIA to version 3.6.9 or later
• Restrict access to the /WeGIA/controle/control.php endpoint
• Implement input validation and sanitization for the nextPage parameter
• Monitor for suspicious activity and implement logging and auditing
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is confirmed by the CVE record and the NVD detail page. The fix is available in version 3.6.9. Evidence is limited to public CVE and NVD records. Defenders should verify WeGIA version and upgrade to 3.6.9 if vulnerable. Additional verification tasks may be needed based on specific environment configurations and potential exposure.

Official resources