CVE-2025-55169: Wegia Path Traversal Vulnerability

CVE-2025-55169 Overview

CVE-2025-55169 is a path traversal vulnerability in WeGIA, an open source web manager built for Portuguese-language charitable institutions. The flaw exists in the html/socio/sistema/download_remessa.php endpoint in versions prior to 3.4.8. An unauthenticated attacker can manipulate the file parameter to read arbitrary files on the server, including config.php, which stores database credentials. Successful exploitation grants direct access to the backing database and any sensitive data it contains. The maintainers patched the issue in version 3.4.8 by removing the vulnerable script entirely.

Critical Impact
Unauthenticated attackers can read config.php over the network, extract database credentials, and pivot to full database compromise.

Affected Products

WeGIA versions prior to 3.4.8
html/socio/sistema/download_remessa.php endpoint
Deployments exposing WeGIA to untrusted networks

Discovery Timeline

2025-08-12 - CVE-2025-55169 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55169

Vulnerability Analysis

The vulnerability is a classic path traversal [CWE-22] in the download_remessa.php file download endpoint. The script accepts a file parameter via HTTP GET and concatenates it directly onto a base path (BKP_DIR/arquivos_rem/) without validating or normalizing the input. Because there is no check for directory traversal sequences such as ../, an attacker can escape the intended arquivos_rem directory and reference any file readable by the PHP process.

After constructing the target path, the script calls file_exists() and then streams the file back to the client using Content-Disposition: attachment headers. This turns the endpoint into a generic arbitrary-file-read primitive. Reading config.php yields the database connection string, credentials, and other sensitive configuration constants used across the WeGIA installation.

Root Cause

The root cause is unsanitized user input flowing into a file system path. The endpoint requires no authentication, performs no canonicalization, and applies no allowlist of permitted filenames. Any request supplying a crafted file value is honored.

Attack Vector

Exploitation requires only network access to the WeGIA web root. An attacker issues a GET request to download_remessa.php with a file parameter containing ../ sequences to traverse out of the backup directory and reach configuration files, session data, or other application source.

php

// Vulnerable code removed in the 3.4.8 patch (html/socio/sistema/download_remessa.php)
<?php
    require("../conexao.php");
    $config_path = "config.php";
    if(file_exists($config_path)){
        require_once($config_path);
    }else{
        while(true){
            $config_path = "../" . $config_path;
            if(file_exists($config_path)) break;
        }
        require_once($config_path);
    }
    if(isset($_GET['file'])){
        $file = $_GET['file'];
        if(substr(BKP_DIR, -1) == "/"){
            $filepath = BKP_DIR."arquivos_rem/".$file;
        }
        else{
            $filepath = BKP_DIR."/"."arquivos_rem/".$file;
        }
        // File is streamed back to the client without traversal validation
        if(file_exists($filepath)){
            header('Content-Description: File Transfer');
            header('Content-Type: application/octet-stream');
            header('Content-Disposition: attachment; filename=' . basename($filepath));
        }
    }

Source: GitHub patch commit e8476168

Detection Methods for CVE-2025-55169

Indicators of Compromise

HTTP requests to /html/socio/sistema/download_remessa.php containing ../ or URL-encoded %2e%2e%2f sequences in the file parameter.
Requests targeting download_remessa.php?file=config.php or paths referencing conexao.php, /etc/passwd, or application source files.
Web server access logs showing successful 200 responses with Content-Type: application/octet-stream originating from download_remessa.php.

Detection Strategies

Inspect web server and reverse proxy logs for requests to the vulnerable endpoint with suspicious file query values.
Deploy WAF rules that block path traversal patterns on any WeGIA URI, particularly download_remessa.php.
Correlate outbound database connection anomalies with prior file-read requests to identify credential theft follow-on activity.

Monitoring Recommendations

Alert on any access to download_remessa.php on WeGIA instances running versions prior to 3.4.8.
Monitor database authentication logs for logins from unexpected source IPs after the initial exposure window.
Track file integrity on config.php and rotate database credentials if unauthorized access is suspected.

How to Mitigate CVE-2025-55169

Immediate Actions Required

Upgrade WeGIA to version 3.4.8 or later, which removes the vulnerable download_remessa.php script.
Rotate all secrets stored in config.php, including database credentials and any API keys, on affected installations.
Restrict network exposure of WeGIA to trusted networks or place it behind an authenticated reverse proxy while patching.

Patch Information

The vulnerability is fixed in WeGIA 3.4.8. The patch removes html/socio/sistema/download_remessa.php from the codebase, eliminating the vulnerable endpoint. Details are available in the GitHub Security Advisory GHSA-mm3p-7573-4x4j and the patch commit.

Workarounds

If immediate upgrade is not possible, delete or rename html/socio/sistema/download_remessa.php on the server.
Add a web server rule (Apache Deny, Nginx return 403) blocking access to the download_remessa.php URI.
Enforce WAF signatures rejecting ../ and URL-encoded traversal sequences in query parameters.

bash

# Nginx workaround: block the vulnerable endpoint until upgrade
location ~* /html/socio/sistema/download_remessa\.php$ {
    return 403;
}

# Apache workaround (.htaccess)
<Files "download_remessa.php">
    Require all denied
</Files>