Remote Code Execution in WeGIA Web Manager for Charitable Institutions

CVE-2025-58159

What is CVE-2025-58159?

WeGIA, a web manager designed for charitable institutions, has a vulnerability that allows attackers to perform remote code execution due to insufficient validation of uploaded files. Prior to version 3.4.11, the application permitted the upload of files with arbitrary names, including potentially dangerous .php files. This occurs because the uploaded files are written directly to disk without proper sanitization or extension checks. As a result, an attacker could manipulate file uploads to execute arbitrary code on the server. This is a critical risk for users of the platform and has been addressed in version 3.4.11, which mitigates the issue.

References