CVE-2025-26615: Path Traversal endpoint 'examples.php' parameter 'src' in WeGIA
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Path Traversal vulnerability was discovered in the WeGIA application, examples.php endpoint. This vulnerability could allow an attacker to gain unauthorized access to sensitive information stored in config.php. config.php contains information that could allow direct access to the database. This issue has been addressed in version 3.2.14 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIA examples.php (src path traversal)to a version that resolves this vulnerability.Fixed in 3.2.14 - Compensating control
Because there are no known workarounds, restrict exposure of the WeGIA examples.php endpoint (and its src parameter) until the application is upgraded to 3.2.14.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26615?
CVE-2025-26615 has been classified with a medium severity due to its Path Traversal nature which can lead to unauthorized access.
How do I fix CVE-2025-26615?
To fix CVE-2025-26615, update WeGIA to version 3.2.15 or later, where the vulnerability has been addressed.
Which versions of WeGIA are affected by CVE-2025-26615?
CVE-2025-26615 affects WeGIA versions up to and including 3.2.14.
What type of vulnerability is CVE-2025-26615?
CVE-2025-26615 is a Path Traversal vulnerability that may allow unauthorized access to sensitive information.
Can CVE-2025-26615 be exploited remotely?
Yes, CVE-2025-26615 can potentially be exploited remotely if the attacker knows the affected endpoint.