The vulnerability arises in WeGIA’s file upload handling for the docdependente module. When an attacker uploads a file with malicious content, the application returns an overly detailed error message that reveals internal implementation details. This exposure falls under the Information Disclosure weakness (CWE‑200). The disclosed information could aid attackers in understanding the application's structure or in refining additional exploits, thereby increasing the overall attack surface.

Affecting all installations of WeGIA prior to version 3.6.10, including the LabRedesCefetRJ WeGIA web manager for charitable institutions. The issue resides in funcionario/docdependente_upload.php and is fixed in release 3.6.10 and later.

While the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the risk is rooted in the ability to glean technical details through normal usage of the file upload endpoint. The attack vector is inferred to be remote file upload via an authenticated or unauthenticated user with upload privileges. Due to the lack of an exploitable code execution path, the immediate threat is limited to information disclosure, yet it can facilitate more targeted attacks in the future.