CVE-2025-26613
Published: 18 February 2025
Summary
CVE-2025-26613 is a critical-severity OS Command Injection (CWE-78) vulnerability in Wegia Wegia. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 19.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
WeGIA is an open source web manager application aimed at Portuguese-language institutional users. The vulnerability is an OS command injection flaw (CWE-78) present in the gerenciar_backup.php endpoint that permits unauthenticated remote execution of arbitrary operating system commands. It carries a CVSS 4.0 score of 10.0 and is also associated with CWE-284.
An attacker with network access can submit crafted input to the affected endpoint and obtain arbitrary code execution on the server without requiring credentials or user interaction. Successful exploitation grants full control over the application and underlying host, including the ability to read, modify, or delete data and potentially pivot within the environment.
The GitHub Security Advisory GHSA-g3w6-m6w8-p6r2 states that the issue is resolved in WeGIA version 3.2.14 and recommends immediate upgrade, noting that no workarounds are available. The EPSS score rose from a low baseline to a peak of 0.0398, indicating that exploitation interest increased after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5102
Vulnerability details
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. An OS Command Injection vulnerability was discovered in the WeGIA application, `gerenciar_backup.php` endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely.…
more
This issue has been addressed in version 3.2.14 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in public-facing web app directly enables T1190 (Exploit Public-Facing Application) for initial remote access and T1059 (Command and Scripting Interpreter) for arbitrary OS command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents OS command injection in gerenciar_backup.php by validating and rejecting malicious inputs before they reach system command execution.
Remediates the specific OS command injection vulnerability by requiring timely upgrades to the patched WeGIA version 3.2.14.
Mitigates unauthenticated remote exploitation by inspecting and blocking command injection attempts at the web application boundary.