by Kastro
Paper/Archive/CVE-2025-26615

CVE-2025-26615

LabRedesCefetRJ WeGIA — Path Traversal endpoint 'examples.php' parameter 'src' in WeGIA

EPSS 0.8%public exploitCVSS 10.0
critical.is priorityof 100
51
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 55.4.554 × 2011.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Path Traversal vulnerability was discovered in the WeGIA application, `examples.php` endpoint. This vulnerability could allow an attacker to gain unauthorized access to sensitive information stored in `config.php`. `config.php` contains information that could allow direct access to the database. This issue has been addressed in version 3.2.14 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected

ProductAffectedFixed inSource
WeGIA< 3.2.14–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-p5wx-pv8j-f96h