Cyber Posture

CVE-2025-26615

CriticalPublic PoC

Published: 18 February 2025

Published
18 February 2025
Modified
28 February 2025
KEV Added
Patch
CVSS Score 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0046 64.1th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

Security Summary

CVE-2025-26615 is a Path Traversal vulnerability (CWE-22, CWE-284) affecting WeGIA, an open-source web manager for institutions primarily targeting Portuguese-language users. The issue resides in the examples.php endpoint, which enables attackers to bypass access controls and read sensitive files, specifically config.php. This file stores database connection details, exposing credentials that could facilitate further unauthorized access.

The vulnerability carries a maximum CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating it is exploitable remotely over the network by unauthenticated attackers with low complexity and no user interaction required. Exploitation allows retrieval of config.php contents, granting direct database access and potentially leading to confidentiality, integrity, and availability impacts across the scoped application.

The vulnerability has been addressed in WeGIA version 3.2.14, with all users urged to upgrade promptly. No workarounds are available. Additional details are provided in the GitHub Security Advisory at https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-p5wx-pv8j-f96h.

Details

CWE(s)
CWE-22CWE-284

Affected Products

wegia
wegia
≤ 3.2.14

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
Why these techniques?

Path traversal in public-facing WeGIA web app enables remote file read of config.php containing DB credentials, mapping to T1190 for initial access and T1552.001 for credential access.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References