CVE-2025-55171: Wegia Auth Bypass Vulnerability

CVE-2025-55171 Overview

CVE-2025-55171 is a missing authentication vulnerability [CWE-287] in WeGIA, an open source web manager focused on Portuguese-language charitable institutions. The flaw affects all versions prior to 3.4.8. The endpoint /html/personalizacao_remover.php does not verify authentication before processing deletion requests. Anonymous attackers can delete arbitrary image files by supplying an image identifier through the imagem_0 parameter. The maintainers patched the issue in version 3.4.8.

Critical Impact
Unauthenticated remote attackers can delete arbitrary image files from a WeGIA deployment, degrading application integrity and availability for charitable institution operations.

Affected Products

WeGIA versions prior to 3.4.8
Endpoint: /html/personalizacao_remover.php
Vendor: LabRedesCefetRJ (WeGIA project)

Discovery Timeline

2025-08-12 - CVE-2025-55171 published to the National Vulnerability Database (NVD)
2025-08-14 - Last updated in NVD database
Patch commit - Fix delivered in WeGIA commit aa63f49 and released in version 3.4.8

Technical Details for CVE-2025-55171

Vulnerability Analysis

The vulnerability is a broken access control issue classified as missing authentication for a critical function [CWE-287]. WeGIA exposes a customization removal endpoint at /html/personalizacao_remover.php that handles image deletion requests. The endpoint omits session validation and authentication checks before invoking file deletion logic. Any unauthenticated network client can send a crafted request and trigger removal of image assets referenced by the supplied identifier.

The impact is limited to availability of stored image files. Confidentiality and integrity of other application data remain unaffected based on the patch scope. Deleted images may include branding, donor records, or beneficiary materials used by charitable institutions, disrupting normal operations.

Root Cause

The root cause is the absence of an authentication guard on /html/personalizacao_remover.php. The script processes the imagem_0 parameter as the target image identifier without first verifying that the requester holds a valid authenticated session. Version 3.4.8 introduces the missing session and permission validation before the destructive operation runs.

Attack Vector

Exploitation requires only network access to the WeGIA web interface. An attacker issues an HTTP request to /html/personalizacao_remover.php with the imagem_0 parameter set to the identifier of the image to delete. No credentials, user interaction, or prior reconnaissance beyond enumerating image identifiers is required. The vulnerability is reachable from any client that can reach the application.

A detailed description of the request pattern is available in the WeGIA Security Advisory GHSA-8rm5-3jvx-hcxv and the related issue discussion.

Detection Methods for CVE-2025-55171

Indicators of Compromise

Unauthenticated HTTP requests to /html/personalizacao_remover.php in web server access logs.
Requests containing the imagem_0 parameter originating from sessions with no prior authenticated login activity.
Unexpected disappearance of image files from WeGIA customization directories.

Detection Strategies

Review web server and application logs for accesses to /html/personalizacao_remover.php that lack an associated authenticated session cookie.
Correlate file deletion events on the WeGIA media storage directories with HTTP request logs to identify anonymous deletions.
Compare deployed WeGIA version against 3.4.8 and flag any host running an earlier release.

Monitoring Recommendations

Enable verbose access logging on the WeGIA web server and forward logs to a centralized analytics platform for correlation.
Monitor file integrity on directories storing WeGIA images and alert on unscheduled deletions.
Track HTTP 200 responses returned by deletion endpoints when the originating request lacks authentication headers or session identifiers.

How to Mitigate CVE-2025-55171

Immediate Actions Required

Upgrade WeGIA to version 3.4.8 or later, which contains the authentication check on /html/personalizacao_remover.php.
Audit existing image storage directories and restore any missing files from backup if unauthorized deletions are confirmed.
Restrict network access to the WeGIA administrative interface to trusted networks until the upgrade completes.

Patch Information

The fix is contained in WeGIA commit aa63f49 and released in version 3.4.8. Refer to the GitHub Security Advisory GHSA-8rm5-3jvx-hcxv for the official advisory.

Workarounds

Block external access to /html/personalizacao_remover.php at the reverse proxy or web application firewall layer until the patch is applied.
Require an authenticated session cookie at the proxy layer for any request to WeGIA /html/ endpoints handling state changes.
Maintain offline backups of WeGIA image directories to enable rapid recovery of deleted assets.

bash

# Example nginx rule to require authentication header on the vulnerable endpoint
location = /html/personalizacao_remover.php {
    if ($http_cookie !~* "PHPSESSID=") {
        return 403;
    }
    proxy_pass http://wegia_backend;
}