CVE-2025-26616: Path Traversal endpoint 'exportar_dump.php' parameter 'file' in WeGIA
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Path Traversal vulnerability was discovered in the WeGIA application, exportardump.php endpoint. This vulnerability could allow an attacker to gain unauthorized access to sensitive information stored in config.php. config.php contains information that could allow direct access to the database. This issue has been addressed in version 3.2.14 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.2.14
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26616?
CVE-2025-26616 has been classified as a medium severity vulnerability due to the potential for unauthorized access to sensitive information.
How do I fix CVE-2025-26616?
To address CVE-2025-26616, update WeGIA to version 3.2.15 or later where the vulnerability has been patched.
What type of vulnerability is CVE-2025-26616?
CVE-2025-26616 is a Path Traversal vulnerability that affects the exportar_dump.php endpoint in the WeGIA application.
Who is affected by CVE-2025-26616?
CVE-2025-26616 affects users of WeGIA versions up to 3.2.14.
What could an attacker do exploiting CVE-2025-26616?
An attacker exploiting CVE-2025-26616 could gain unauthorized access to sensitive information on the WeGIA application.