CVE-2025-58159: WeGIA Authenticated Arbitrary File Upload Leading To Remote Code Execution (RCE)
WeGIA is a Web manager for charitable institutions. Prior to version 3.4.11, a remote code execution vulnerability was identified, caused by improper validation of uploaded files. The application allows an attacker to upload files with arbitrary filenames, including those with a .php extension. Because the uploaded file is written directly to disk without adequate sanitization or extension restrictions, a spreadsheet file followed by PHP code can be uploaded and executed on the server, leading to arbitrary code execution. This is due to insufficient mitigation of CVE-2025-22133. This issue has been patched in version 3.4.11.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58159?
CVE-2025-58159 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-58159?
To mitigate CVE-2025-58159, upgrade WeGIA to version 3.4.11 or later, which addresses the file upload validation issue.
What type of vulnerability is CVE-2025-58159?
CVE-2025-58159 is a remote code execution vulnerability caused by improper validation of uploaded files.
Who is affected by CVE-2025-58159?
WeGIA users running versions prior to 3.4.11 are affected by CVE-2025-58159.
What can an attacker do with CVE-2025-58159?
An attacker can exploit CVE-2025-58159 to upload malicious files, including PHP scripts, leading to remote code execution on the server.