CVE-2025-55169 Details
Description
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in the WeGIA application, html/socio/sistema/download_remessa.php endpoint. This vulnerability could allow an attacker to gain unauthorized access to local files in the server and sensitive information stored in config.php. config.php contains information that could allow direct access to the database. This issue has been patched in version 3.4.8.
A path traversal vulnerability has been identified in the WeGIA application, specifically in the file download endpoint located at 'html/socio/sistema/download_remessa.php'. This vulnerability, present in versions through 3.4.7, allows unauthorized access to local files on the server, including sensitive information stored in 'config.php', which contains database credentials. The vulnerability exists because user input is not properly sanitized before constructing file paths, and the endpoint can be accessed without authentication.
The vulnerability has been patched in WeGIA version 3.4.8, which removes the vulnerable 'download_remessa.php' file from the application.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 12, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LabRedesCefetRJ/WeGIA/commit/e8476168171de2f3e047ed92bbc264c981b416b1 | [email protected] | Patch |
| https://github.com/LabRedesCefetRJ/WeGIA/issues/177 | [email protected] | Issue TrackingMitigation |
| https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mm3p-7573-4x4j | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wegia wegia | < 3.4.8 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 14, 2025 | Initial Analysis | [email protected] |
| Aug 12, 2025 | New CVE Received | [email protected] |