CVE-2025-55169
BaseFortify
Publication date: 2025-08-12
Last updated on: 2025-08-14
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wegia | wegia | to 3.4.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a path traversal issue in the WeGIA web manager application prior to version 3.4.8. It occurs in the html/socio/sistema/download_remessa.php endpoint and allows an attacker to access local files on the server without authorization. Specifically, an attacker could access sensitive files like config.php, which contains database access information.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to gain unauthorized access to sensitive files on the server, such as config.php, which contains database credentials. This could lead to further compromise of the database and potentially the entire system, resulting in data breaches and loss of confidentiality.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability could lead to unauthorized access to sensitive data, which may result in non-compliance with data protection regulations such as GDPR and HIPAA. Exposure of confidential information could trigger legal and regulatory consequences due to failure to protect personal or sensitive data.
What immediate steps should I take to mitigate this vulnerability?
Upgrade the WeGIA application to version 3.4.8 or later, as this version contains the patch that fixes the path traversal vulnerability in the html/socio/sistema/download_remessa.php endpoint.