PT-2025-7215 · Wegia · Wegia

Chan-Woong + 1 · Published 2025-02-18 · Updated 2025-02-18 · CVE-2025-26616

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.14

Description: A Path Traversal issue was discovered in the WeGIA application, affecting the exportar dump.php endpoint. This could allow an attacker to gain unauthorized access to sensitive information stored in config.php, which contains data that could enable direct access to the database.

Recommendations: For versions prior to 3.2.14, upgrade to version 3.2.14 to address the issue. As a temporary workaround, consider restricting access to the exportar dump.php endpoint until the upgrade is applied. Additionally, restrict access to the config.php file to minimize the risk of exploitation. At the moment, there is no other information about additional mitigation measures.

Exploit

Fix

Improper Access Control

Path traversal

Weakness Enumeration

CWE-284

CWE-22

Related Identifiers

CVE-2025-26616

GHSA-XXQG-P22H-3F32

Affected Products

Wegia

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26616.json · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-xxqg-p22h-3f32 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26616 · Security Note
• https://osv.dev/vulnerability/CVE-2025-26616 · Vendor Advisory
• https://twitter.com/CVEnew/status/1891951336440332314 · Twitter Post
• https://t.me/thedarkwebinformer/12841 · Telegram Post
• https://t.me/latest_high_impact_cve/1847 · Telegram Post
• https://t.me/cvedetector/18357 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1891972409353199733 · Twitter Post
• https://twitter.com/CveFindCom/status/1891956647435567394 · Twitter Post