CVE-2025-22133: WeGIA Allows Arbitrary File Upload with Remote Code Execution (RCE)
First published: Tue Jan 07 2025(Updated: )
WeGIA is a web manager for charitable institutions. Prior to 3.2.8, a critical vulnerability was identified in the /WeGIA/html/socio/sistema/controller/controla_xlsx.php endpoint. The endpoint accepts file uploads without proper validation, allowing the upload of malicious files, such as .phar, which can then be executed by the server. This vulnerability is fixed in 3.2.8.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Wegia Wegia | <3.2.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-22133?
CVE-2025-22133 has been classified as critical due to improper file validation allowing for potential malicious file uploads.
How do I fix CVE-2025-22133?
To mitigate CVE-2025-22133, upgrade WeGIA to version 3.2.8 or later where the vulnerability has been resolved.
What versions of WeGIA are affected by CVE-2025-22133?
All versions of WeGIA prior to 3.2.8 are affected by CVE-2025-22133.
What types of attacks can CVE-2025-22133 lead to?
CVE-2025-22133 can lead to remote code execution through the upload of malicious files due to the lack of proper file validation.
Is there a public advisory for CVE-2025-22133?
Yes, there is a public advisory available for CVE-2025-22133 detailing the vulnerability and recommended actions.
- agent/weakness
- agent/title
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/wegia
- canonical/wegia web manager for charitable institutions