PT-2025-7214 · Wegia · Wegia

Chan-Woong + 1 · Published 2025-02-18 · Updated 2025-02-18 · CVE-2025-26615

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.14

Description: A Path Traversal vulnerability was discovered in the WeGIA application, affecting the examples.php endpoint. This issue could allow an attacker to gain unauthorized access to sensitive information stored in config.php, which contains data that could permit direct access to the database.

Recommendations: For versions prior to 3.2.14, upgrade to version 3.2.14 to secure sensitive information stored in config.php. As a temporary workaround, consider restricting access to the examples.php endpoint until the upgrade is applied. Additionally, avoid using the config.php file in a way that could expose its contents until the issue is resolved.

Exploit

Fix

Improper Access Control

Path traversal

Weakness Enumeration

CWE-284

CWE-22

Related Identifiers

CVE-2025-26615

GHSA-P5WX-PV8J-F96H

Affected Products

Wegia

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26615.json · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-p5wx-pv8j-f96h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26615 · Security Note
• https://osv.dev/vulnerability/CVE-2025-26615 · Vendor Advisory
• https://t.me/thedarkwebinformer/12841 · Telegram Post
• https://twitter.com/CVEnew/status/1891953401111757024 · Twitter Post
• https://t.me/latest_high_impact_cve/1847 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1891985209484091839 · Twitter Post
• https://t.me/cvedetector/18365 · Telegram Post
• https://twitter.com/CveFindCom/status/1891956705593905484 · Twitter Post