PT-2025-32886 · Wegia · Wegia

Ducluongtran9121 + 1 · Published 2025-08-12 · Updated 2025-09-02 · CVE-2025-55169

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.8

Description: WeGIA is a web manager focused on the Portuguese language and charitable institutions. A path traversal vulnerability exists in the html/socio/sistema/download remessa.php endpoint. This could allow an attacker to gain unauthorized access to local files on the server and sensitive information stored in config.php, which contains information that could allow direct access to the database.

Recommendations: Update to version 3.4.8 or later.

Exploit

Fix

Improper Authentication

Path traversal

Weakness Enumeration

CWE-287

CWE-22

Related Identifiers

CVE-2025-55169

GHSA-MM3P-7573-4X4J

Affected Products

Wegia

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55169.json · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mm3p-7573-4x4j · Vendor Advisory
• https://github.com/LabRedesCefetRJ/WeGIA/commit/e8476168171de2f3e047ed92bbc264c981b416b1 · Patch
• https://osv.dev/vulnerability/CVE-2025-55169 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55169 · Security Note
• https://github.com/LabRedesCefetRJ/WeGIA/issues/177 · Note
• https://reddit.com/r/u_HEALSecurity/comments/1n6jswh/weekly_vulnerability_on_the_rise_aug_18_to_aug_24 · Reddit Post
• https://twitter.com/CVEnew/status/1955535846247116922 · Twitter Post