Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

WeGIA allows attackers to upload files and run code

CVE-2025-58159 · published 1 year ago
Summary

Versions of WeGIA before 3.4.11 let someone upload a file with any name, including scripts, that is saved on the server without proper checks. A malicious file can be executed, giving the attacker control of the system. Update to version 3.4.11 or later to stop this behavior.

What to do
  • Update wegia wegia to version 3.4.11 or later.
Affected software
VendorProductAffected versions
wegia wegia < 3.4.11
cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*
Original advisory text
WeGIA Authenticated Arbitrary File Upload Leading To Remote Code Execution (RCE)
WeGIA is a Web manager for charitable institutions. Prior to version 3.4.11, a remote code execution vulnerability was identified, caused by improper validation of uploaded files. The application allows an attacker to upload files with arbitrary filenames, including those with a .php extension. Because the uploaded file is written directly to disk without adequate sanitization or extension restrictions, a spreadsheet file followed by PHP code can be uploaded and executed on the server, leading to arbitrary code execution. This is due to insufficient mitigation of CVE-2025-22133. This issue has been patched in version 3.4.11.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
CWE-434Unrestricted File Upload
Timeline
Published29 Aug 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-58159 · NVD
CVE-2025-58159 · OSV
GHSA-wj2c-237g-cgqp · GHSA
Track software like this
Free during beta