OS Command Injection Vulnerability in WeGIA Web Manager for Institutions
CVE-2025-26613

10CRITICAL

Key Information:

Vendor
Labredescefetrj
Status
Wegia
Vendor
CVE Published:
18 February 2025

Summary

The WeGIA Web Manager for Institutions contains a vulnerability in the gerenciar_backup.php endpoint that allows an attacker to execute arbitrary commands on the server, potentially compromising the entire application. Users are strongly encouraged to upgrade to version 3.2.14 to remediate this issue, as there are no workarounds available. This vulnerability specifically affects Portuguese language users of the open-source application, highlighting a critical need for timely updates.

Affected Version(s)

WeGIA < 3.2.14

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisor...
x_refsource_CONFIRM

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.