CVE-2026-35472 describes an Open Redirect vulnerability in the WeGIA application by LabRedesCefetRJ. Specifically, the nextPage parameter in the /WeGIA/controle/control.php endpoint is not properly validated when combined with metodo=listarTodos and nomeClasse=EstoqueControle, enabling attackers to redirect users to untrusted external URLs. This flaw can be exploited to conduct phishing or social engineering attacks leveraging the trusted WeGIA domain. The vulnerability affects versions prior to 3.6.9 and has been resolved in that release.

Successful exploitation allows attackers to redirect users to arbitrary external websites, which can be used for phishing, credential theft, malware distribution, or other social engineering attacks. The vulnerability does not directly compromise the application or user data but leverages user trust in the legitimate domain to facilitate attacks.

This vulnerability is fixed in WeGIA version 3.6.9. Users and administrators should upgrade to version 3.6.9 or later to remediate this issue. No other mitigation guidance is provided or necessary as the fix addresses the root cause.