Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

WeGIA allows remote code execution via backup file parameter

CVE-2025-26613 · published 1 year ago
Summary

The WeGIA web manager lets users manage backups, but the page that handles backup files can be tricked into running any command the attacker supplies. This could let an attacker take control of the server hosting WeGIA. Upgrade to version 3.2.14 or later as soon as possible; there is no other fix.

What to do
  • Update wegia wegia to version 3.2.14 or later.
Affected software
VendorProductAffected versions
wegia wegia < 3.2.14
cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*
Original advisory text
OS Command Injection endpoint 'gerenciar_backup.php' parameter 'file' (RCE) in WeGIA
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. An OS Command Injection vulnerability was discovered in the WeGIA application, `gerenciar_backup.php` endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely. This issue has been addressed in version 3.2.14 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
3% chance of attack within 30 days
Type
CWE-78OS Command Injection
CWE-284Improper Access Control
Timeline
Published18 Feb 2025
Updated29 Oct 2026
First seen7 Mar 2026
Sources
CVE-2025-26613 · NVD
CVE-2025-26613 · OSV
GHSA-g3w6-m6w8-p6r2 · GHSA
Track software like this
Free during beta