The vulnerability in WeGIA prior to version 3.8.5 involves improper limitation of pathname to a restricted directory (CWE-22) and missing authentication on sensitive controller methods (CWE-306). The contribution request dispatcher accepts attacker-controlled 'nomeClasse' and 'metodo' parameters without a complete allowlist and constructs include paths without canonical directory containment. This allows an unauthenticated attacker to invoke sensitive methods such as getContribuicoesLogJSON, sincronizarStatus, and registrarFaturas, leading to disclosure of contribution and donation records or triggering financial workflows. Additionally, a specially crafted 'nomeClasse' value can cause require_once to include files outside the intended controller directory, exposing source code or credentials. The vulnerability is addressed in version 3.8.5.

An unauthenticated remote attacker can exploit this vulnerability to access sensitive contribution and donation records, trigger financial workflow operations, and potentially disclose source code or credentials by including arbitrary files. The CVSS 3.1 base score is 9.1 (critical), reflecting high confidentiality and integrity impact with no required privileges or user interaction.

This vulnerability is fixed in WeGIA version 3.8.5. Users should upgrade to version 3.8.5 or later to remediate this issue. No other mitigation steps are indicated by the vendor advisory.