CVE-2025-55169CWE-22CWE-287

WeGIA Path Traversal at endpoint 'html/socio/sistema/download_remessa.php' via parameter 'file'

Critical · published August 12, 2025

CVSS v4.0
10.0
EPSS
2%
Percentile
76.2
In the wild
Unconfirmed
What it is

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in the WeGIA application, html/socio/sistema/download_remessa.php endpoint. This vulnerability could allow an attacker to gain unauthorized access to local files in the server and sensitive information stored in config.php. config.php contains information that could allow direct access to the database. This issue has been patched in version 3.4.8.

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.01639 · 76.2th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-287 · Improper Authentication
Published
2025-08-12T19:01Z
EPSS history
Timeline
  • 12 AUG 19:01Z
    WeGIA Path Traversal at endpoint 'html/socio/sistema/download_remessa.php' via parameter 'file'
    cvelistv5