CVE-2026-28409

GitHubCurated repository PoCExploitCexploitintel/eip-pocs-and-cves

PoC files

18 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains three self-contained Python 3 PoC scripts (poc.py, poc_vector2.py, poc_vector3.py) that actively exploit CVE-2026-28409, an OS command injection vulnerability in WeGIA <= 3.6.4. The scripts authenticate to the target, upload a crafted .tar.gz file with a malicious filename containing shell metacharacters ($(), ;, ``), and trigger a database restore operation that passes the filename to shell_exec(), resulting in arbitrary command execution. Verification is performed via file-write and timing-based detection.

Backdoor review

No backdoor observed in reviewed code

All reviewed PoC scripts and documentation target the stated CVE-2026-28409 vulnerability in WeGIA. The Python scripts perform authentication, upload a crafted tar.gz file, and trigger a database restore to achieve OS command injection on the target server. No concealed backdoor, unrelated payload, credential exfiltration, or persistence mechanism was observed. The scripts use only standard library modules and interact exclusively with the vulnerable WeGIA application endpoints.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagespython
Target softwareWeGIA
Attack typesOS command injectionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact includes multiple Python scripts (poc.py, poc_vector2.py, poc_vector3.py) that are designed to actively exploit CVE-2026-28409 by sending crafted HTTP requests to a vulnerable WeGIA instance to achieve remote code execution. The code performs the full attack chain: authentication, malicious file upload, and triggering the vulnerable function, which constitutes an exploit.

poc/poc.py:1-411poc/poc_vector2.py:1-194poc/poc_vector3.py:1-192

Requirements

  • Valid WeGIA administrative credentials (default admin/wegia) or a bypass for authentication.poc/poc.py:139-171
  • Network access to the WeGIA web application's login, upload, and restore endpoints.poc/poc.py:155-157poc/poc.py:193-198poc/poc.py:239-245

Observed behavior

  • Authenticates to the WeGIA application using provided credentials and extracts a PHP session ID.poc/poc.py:139-171
  • Constructs a valid .tar.gz archive in memory and uploads it via a multipart/form-data POST request with a malicious filename containing shell metacharacters (e.g., $(echo MARKER > rce_out).dump.tar.gz).poc/poc.py:86-99poc/poc.py:174-214
  • Triggers the database restore action by sending a POST request to gerenciar_backup.php with the malicious filename, causing the shell_exec() call to execute the injected OS command.poc/poc.py:217-252
  • Verifies command execution by checking for a file written to the backup directory (file-write proof) or by measuring a delay in the HTTP response (timing-based proof).poc/poc.py:293-326poc/poc.py:356-371
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Target Behavior
PoC scripts authenticate to WeGIA, upload a crafted backup file, and trigger a restore to execute OS commands via shell_exec() injection.This is the documented exploit behavior for CVE-2026-28409 and does not indicate a backdoor.poc/poc.py:139-252poc/poc_vector2.py:92-181poc/poc_vector3.py:86-177
Verification Method
PoC uses file-write (echo marker to BKP_DIR) and timing-based (sleep) verification to confirm command execution on the target.These are standard techniques for blind OS command injection verification and do not constitute backdoor behavior.poc/poc.py:78-81poc/poc.py:257-269
Network Communication
All HTTP requests target the WeGIA application endpoints (/html/login.php, /html/configuracao/importar_dump.php, /html/configuracao/gerenciar_backup.php).No external or unrelated network connections are made by the PoC scripts.poc/poc.py:156-157poc/poc.py:194-195poc/poc.py:240-241
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository unit were included. The analysis is based on the 6 selected text files provided.
  • The evidence includes a non-text media file (37002 bytes) and 11 unclassified files (44008 bytes) that were not analyzed, which may contain additional context or code.
  • 11 unclassified files and 1 non-text media file were present in the artifact but not included in the text evidence; their content was not reviewed.
  • Binary files were flagged as metadata-only and not analyzed; no binary files were reported as part of the selected text evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

2
GitHub

CVE-2026-28409/docker-compose-bypass.yml

Created Vuln labCVE-2026-28409Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

Lab screenshot for CVE-2026-28409/docker-compose-bypass.yml
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds and runs a single container hosting a patched instance of WeGIA 3.6.5 (commit 370104c7) for testing bypasses of the CVE-2026-28409 fix. The container bundles Apache, PHP 8.2, and MariaDB, and exposes port 8081 on the host.

CVE-2026-28409/docker-compose-bypass.yml:1-28CVE-2026-28409/Dockerfile.patched:1-103

Lab assessment

Vulnerability lab

The README explicitly describes this as a 'CVE-2026-28409 Bypass Lab' for testing bypasses against the patched version. The Dockerfile builds a WeGIA instance at the fix commit, and the compose file orchestrates it for bypass testing.

CVE-2026-28409/README.md:1-3CVE-2026-28409/docker-compose-bypass.yml:1-3CVE-2026-28409/Dockerfile.patched:1-4
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

patched

vulnerability-lab targetweb applicationdatabase server

A single container built from Dockerfile.patched that runs Apache with PHP 8.2 and MariaDB via supervisord. It hosts a patched WeGIA 3.6.5 instance at commit 370104c7, configured to use a local MariaDB socket. The container exposes port 80, mapped to host port 8081, and includes a healthcheck that curls the index page.

CVE-2026-28409/docker-compose-bypass.yml:8-22CVE-2026-28409/Dockerfile.patched:1-103
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-28409

Supported by supplied evidence

The environment is explicitly built to test bypasses of the CVE-2026-28409 fix. The Dockerfile clones WeGIA at the fix commit 370104c7, and the README describes the original vulnerability and the bypass findings against this patched version.

CVE-2026-28409/README.md:1-3CVE-2026-28409/Dockerfile.patched:1-4CVE-2026-28409/Dockerfile.patched:49-52
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.CVE-2026-28409/README.md:1-3
  • The bypass PoC script (poc/bypass_poc.py) requires Python 3 and targets the patched container on host port 8081.CVE-2026-28409/README.md:1-3

Evidence-described exercise path

  1. Build and start the patched container using 'docker compose -f docker-compose-bypass.yml up -d'.CVE-2026-28409/README.md:1-3
  2. Run the bypass PoC script with 'python3 poc/bypass_poc.py localhost 8081' to test the new vulnerabilities introduced by the fix.CVE-2026-28409/README.md:1-3
  3. Clean up with 'docker compose -f docker-compose-bypass.yml down'.CVE-2026-28409/README.md:1-3
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. The Dockerfile builds a patched WeGIA instance from a known fix commit, copies local config files, and runs only Apache and MariaDB inside the container. The compose file maps port 8081 to the container's port 80 and uses a bridge network. No privileged mode, host volume mounts, or external network connections beyond the documented lab target are present. The PoC scripts target the lab's own container and do not exhibit hidden, destructive, or host-escaping behavior.

CVE-2026-28409/docker-compose-bypass.yml:1-28CVE-2026-28409/Dockerfile.patched:1-103
Review boundaries

What the analysis did not establish

  • The bypass PoC script (poc/bypass_poc.py) is not included in the evidence files, so its exact behavior cannot be assessed.
  • The Dockerfile.patched references COPY instructions for apache-wegia.conf and supervisord.conf, but only the content of apache-wegia.conf is provided; supervisord.conf content is included, but its path in the evidence is under unit_scope, not as a copied build context.
  • The environment is described as a bypass lab, but the actual vulnerability being tested (the bypass) is not fully detailed in the provided evidence beyond the README summary.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

CVE-2026-28409/docker-compose.yml

Created Vuln labCVE-2026-28409Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

Lab screenshot for CVE-2026-28409/docker-compose.yml
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose lab for CVE-2026-28409, an OS command injection vulnerability in WeGIA 3.6.4. It builds a single container running Apache, PHP 8.2, and MariaDB, hosting the vulnerable WeGIA application.

CVE-2026-28409/docker-compose.yml:1-28CVE-2026-28409/Dockerfile.vulnerable:1-100

Lab assessment

Vulnerability lab

The environment is explicitly labeled as a CVE-2026-28409 lab, builds a vulnerable version of WeGIA, and includes PoC scripts to demonstrate the OS command injection.

CVE-2026-28409/docker-compose.yml:1-3CVE-2026-28409/README.md:1-3
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

vulnerable

vulnerable targetweb serverdatabase server

A single container built from Dockerfile.vulnerable that runs WeGIA 3.6.4 on Apache 2.4 with PHP 8.2 and MariaDB, managed by supervisord. It exposes port 80 on host port 28409.

CVE-2026-28409/docker-compose.yml:8-22CVE-2026-28409/Dockerfile.vulnerable:1-100

poc.py

exploit script

A Python 3 script that demonstrates RCE via $() command substitution in the backup filename. It authenticates, uploads a malicious .tar.gz, triggers restore, and verifies via file-write and timing.

CVE-2026-28409/poc/poc.py:1-411

poc_vector2.py

exploit script

A Python 3 script that demonstrates RCE via semicolon (;) command chaining in the backup filename.

CVE-2026-28409/poc/poc_vector2.py:1-194

poc_vector3.py

exploit script

A Python 3 script that demonstrates RCE via backtick (`) command substitution in the backup filename, verified by timing.

CVE-2026-28409/poc/poc_vector3.py:1-192
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-28409

Supported by supplied evidence

The lab builds WeGIA 3.6.4, which is explicitly stated as vulnerable to CVE-2026-28409. The PoC scripts demonstrate OS command injection via the backup filename, matching the described vulnerability.

CVE-2026-28409/README.md:1-3CVE-2026-28409/poc_verification_report.md:1-10
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the lab.CVE-2026-28409/README.md:88-92
  • The vulnerable container must be built and started using 'docker compose up -d'.CVE-2026-28409/docker-compose.yml:5-7
  • The WeGIA database must be seeded with default credentials (admin/wegia) for the PoC to authenticate.CVE-2026-28409/Dockerfile.vulnerable:80-85

Evidence-described exercise path

  1. Build and start the vulnerable container: 'docker compose build && docker compose up -d'.CVE-2026-28409/README.md:88-92
  2. Run the primary PoC script: 'python3 poc/poc.py localhost 28409'.CVE-2026-28409/README.md:95
  3. Observe the output confirming RCE via file-write and timing.CVE-2026-28409/README.md:98-130
  4. Optionally run alternative vectors: 'python3 poc/poc_vector2.py localhost 28409' and 'python3 poc/poc_vector3.py localhost 28409'.CVE-2026-28409/README.md:133-143
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior targets the lab's own container. The PoC scripts exploit the vulnerable WeGIA instance inside the container, and the Dockerfile only sets up the lab environment. No evidence of host escape, external connections, persistence, or credential theft beyond the lab's own default credentials.

CVE-2026-28409/docker-compose.yml:1-28CVE-2026-28409/Dockerfile.vulnerable:1-100CVE-2026-28409/poc/poc.py:1-411
Review boundaries

What the analysis did not establish

  • The packet does not include the actual WeGIA source code, only the Dockerfile that clones it.
  • The PoC scripts use 'docker exec' for verification, which requires host Docker access and is not part of the container's own behavior.
  • The README mentions a bypass PoC and patched Dockerfile, but those files are not included in the evidence.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1