Cross-site scripting in WeGIA - #VU163004
Published: November 9, 2026
Vulnerability identifier: #VU163004
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker to execute arbitrary JavaScript in another user's authenticated WeGIA session.
The vulnerability exists due to missing output encoding of stored memorandum attachment filenames when WeGIA renders attachment links. An authenticated attacker with permission to create and dispatch memorandums can submit a crafted filename that executes JavaScript when the recipient opens the memorandum thread and hovers over the attachment link.
Affected software
WeGIA
Remediation
Install security update from vendor's website.
WeGIA - update to 3.9.3