Nixpkgs Security Tracker

Login with GitHub

Suggestion detail

Dismissed
Permalink CVE-2026-28409
10.0 CRITICAL
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
updated 3 weeks, 1 day ago by @anthonyroussel Activity log
  • Created automatic suggestion 3 weeks, 2 days ago
  • @anthonyroussel removed
    4 packages
    • perlPackages.SnowballNorwegian
    • perl5Packages.SnowballNorwegian
    • perl538Packages.SnowballNorwegian
    • perl540Packages.SnowballNorwegian
    3 weeks, 1 day ago
  • @anthonyroussel dismissed 3 weeks, 1 day ago
WeGIA Vulnerable to Remote Code Execution (RCE) via OS Command Injection

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution (RCE) vulnerability exists in the WeGIA application's database restoration functionality. An attacker with administrative access (which can be obtained via the previously reported Authentication Bypass) can execute arbitrary OS commands on the server by uploading a backup file with a specifically crafted filename. Version 3.6.5 fixes the issue.

References

Affected products

WeGIA
  • ==< 3.6.5
Ignored packages (4) 
Not present in nixpkgs