CVE-2025-54078: Wegia Wegia Reflected XSS Vulnerability

CVE-2025-54078 Overview

CVE-2025-54078 is a Reflected Cross-Site Scripting (XSS) vulnerability in WeGIA, an open source web manager focused on Portuguese-language charitable institutions. The flaw exists in the personalizacao_imagem.php endpoint, where the err parameter reflects unsanitized user input into the response. Attackers can craft a malicious URL that executes arbitrary JavaScript in a victim's browser session. The issue affects all WeGIA versions prior to 3.4.6 and is tracked under [CWE-79]. Version 3.4.6 remediates the vulnerability.

Critical Impact
Successful exploitation allows attackers to execute arbitrary scripts in an authenticated user's browser, enabling session data theft, UI manipulation, and phishing against charitable institution administrators.

Affected Products

WeGIA versions prior to 3.4.6
personalizacao_imagem.php endpoint
Deployments exposing the WeGIA web interface to untrusted networks

Discovery Timeline

2025-07-18 - CVE-2025-54078 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54078

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the WeGIA charitable institution management application. The personalizacao_imagem.php script accepts an err query parameter and writes its value into the HTML response without proper output encoding or input sanitization. When a victim clicks a crafted link, the browser interprets the injected payload as executable script within the WeGIA origin.

Because the payload runs in the context of the authenticated session, attackers can access session cookies not marked HttpOnly, invoke privileged application endpoints on behalf of the victim, and alter rendered content. The vulnerability requires user interaction — typically clicking a crafted URL — but does not require prior authentication of the attacker.

Root Cause

The root cause is missing output encoding of the err query parameter before its inclusion in the HTML response. WeGIA versions prior to 3.4.6 reflect the parameter directly into markup, allowing an attacker-controlled string to break out of its intended context and inject <script> payloads or event-handler attributes.

Attack Vector

An attacker builds a URL pointing to the vulnerable personalizacao_imagem.php endpoint with a JavaScript payload placed in the err parameter. The attacker delivers this URL via phishing email, chat message, or a third-party site. When an authenticated WeGIA user opens the link, the injected script executes in the WeGIA origin and can exfiltrate session data or perform actions as the victim.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-f4j2-mxwh-rfm7 for the vendor's technical description.

Detection Methods for CVE-2025-54078

Indicators of Compromise

Web server access logs containing requests to personalizacao_imagem.php with err parameter values that include <script, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript.
Unusually long or heavily URL-encoded query strings targeting the personalizacao_imagem.php endpoint.
HTTP referrers originating from external domains preceding requests to the vulnerable endpoint.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the err parameter for HTML and JavaScript metacharacters.
Correlate outbound browser requests to attacker-controlled domains immediately following WeGIA page loads, indicating potential data exfiltration from a reflected payload.
Review WeGIA application logs for repeated 200-status requests to personalizacao_imagem.php from a single external referrer.

Monitoring Recommendations

Enable verbose HTTP request logging for all WeGIA endpoints and forward logs to a centralized analytics platform for query and alerting.
Alert on any request to personalizacao_imagem.php whose err value contains angle brackets, quotes, or the strings alert(, onerror, or document.cookie.
Monitor Content Security Policy (CSP) violation reports if CSP headers are deployed in front of WeGIA.

How to Mitigate CVE-2025-54078

Immediate Actions Required

Upgrade WeGIA to version 3.4.6 or later, which contains the vendor fix for this vulnerability.
Audit web server logs for prior exploitation attempts targeting personalizacao_imagem.php.
Invalidate active user sessions and require re-authentication after patching to limit any residual compromise.

Patch Information

The WeGIA maintainers released version 3.4.6, which sanitizes the err parameter before reflecting it in HTML output. Details are available in the GitHub Security Advisory GHSA-f4j2-mxwh-rfm7. Administrators should validate the deployed version by inspecting the WeGIA release metadata after upgrade.

Workarounds

Place WeGIA behind a WAF and block requests where the err parameter contains HTML or JavaScript metacharacters until the upgrade is applied.
Deploy a strict Content-Security-Policy header that disallows inline scripts and restricts script sources to trusted origins.
Restrict access to the WeGIA application to trusted internal networks or VPN users to reduce exposure to phishing-delivered payloads.

bash

# Example nginx rule to block obvious XSS payloads in the err parameter
location ~* /personalizacao_imagem\.php {
    if ($arg_err ~* "(<script|javascript:|onerror=|onload=|%3Cscript)") {
        return 403;
    }
    proxy_pass http://wegia_backend;
}