Arbitrary File Upload Vulnerability in WeGIA Web Manager for Charitable Institutions

CVE-2025-58745

What is CVE-2025-58745?

The WeGIA Web Manager, designed for managing charitable organizations, suffers from a serious flaw that allows arbitrary file uploads. Despite previous mitigations, the system inadequately checks MIME types at a critical endpoint, which attackers can exploit. By leveraging special file signatures known as magic bytes, an intruder can bypass the security checks and upload malicious webshells to the server. This breach could lead to extensive unauthorized access and remote code execution, threatening the integrity and confidentiality of sensitive data.

References