WeGIA versions before 3.6.9 contain a stored XSS vulnerability (CWE-79) where malicious scripts can be injected through backup filenames. This improper neutralization of input during web page generation enables attackers to execute arbitrary scripts in users' browsers, potentially compromising session data or performing unauthorized actions. The vulnerability is addressed in version 3.6.9. The CVSS 4.0 base score is 8.5, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality and integrity.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially compromising session tokens, user data, or enabling actions on behalf of the user. This can result in unauthorized access or manipulation within the affected web application environment. There are no known exploits in the wild at this time.

Upgrade WeGIA to version 3.6.9 or later, where this stored XSS vulnerability has been fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. No additional vendor advisory is provided, so check the vendor's official channels for the update package and installation instructions.