File Upload Vulnerability in WeGIA Web Manager for Charitable Institutions
CVE-2025-22133

9.9CRITICAL

Key Information:

Vendor

WeGIA

Status
Wegia
Vendor
CVE Published:
7 January 2025

What is CVE-2025-22133?

The WeGIA web management system designed for charitable institutions contains a significant vulnerability in the control endpoint that permits unauthorized file uploads. This flaw allows an attacker to upload potentially harmful files, such as .phar files, which could be executed by the server, leading to severe security risks. This vulnerability has been addressed and resolved in version 3.2.8.

References

https://github.com/nilsonLazarin/WeGIA/commit/a08f04de96d...
https://github.com/nilsonLazarin/WeGIA/security/advisorie...

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

.