WeGIA's backup restore function in version 3.6.5 uses PHP's PharData class to extract tar.gz archives and then reads SQL files with file_get_contents() after a glob(). The implementation does not verify whether extracted archive members are symbolic links. An attacker can upload a crafted archive containing symlinks that point to sensitive files on the server, leading to arbitrary file reads and confidentiality compromise. This vulnerability is identified as CWE‑59 (OS Command Injection/Path Traversal).

The affected product is WeGIA Web Manager from LabRedesCefetRJ, specifically version 3.6.5. The cpe identified is cpe:2.3:a:wegia:wegia:3.6.5:*:*:*:*:*:*:*.

The CVSS score is 6.9, indicating moderate severity. The EPSS score is <1%, suggesting low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. The attack requires the ability to upload a backup archive and trigger its restoration, which typically implies local or administrative access to the server. Once the condition is met, the attacker can read arbitrary files exposed to the PHP process. Overall, the risk is moderate and primarily relevant to systems that allow untrusted users to upload or restore backups without validation.