CVE-2025-26606 is a Critical SQL injection flaw (CVSS 9.8) in the WeGIA web manager, in the informacao_adicional.php endpoint. Versions up to 3.2.11 are listed as affected. Upgrade to 3.2.13 or later, which the advisory names as the fix. The advisory lists no workarounds.
What's affected
- Product: WeGIA, an open source web manager for institutions, with a focus on Portuguese language users
- Affected: versions up to and including 3.2.11 per the GitHub advisory
- Endpoint: informacao_adicional.php (GET request on the employee pages)
- Parameter: id_descricao
- Fixed: 3.2.13
WeGIA publishes a run of closely related advisories from the same report. Several were fixed in 3.2.13 and the command injection and a few SQL injection fixes landed in 3.2.14. If you are on anything older than 3.2.14, upgrade to the latest release rather than picking one fix.
The advisory says there is a redirect to the login page when no user is signed in, but the code does not stop running after the redirect. The query therefore still runs for a visitor who is not logged in.
How to check if you're exposed
WeGIA is deployed as an application on a PHP server, so the version is the version of the release you installed. If you installed from the project repository, check the tag:
git -C /path/to/WeGIA describe --tags
# confirm the endpoint exists in your copy
find /path/to/WeGIA -name "informacao_adicional.php"
If the tag is 3.2.11 or earlier, you are affected. If you downloaded a release archive, compare the release label with the numbers above and read the advisory for your version. Check your web server access logs for requests to informacao_adicional.php with unusual values in the id_descricao parameter, going back to before the advisory was published on 16 February 2025.
What to do now
- Back up the application files and database, then upgrade WeGIA to the latest release. At minimum, reach 3.2.13.
- Because there is no workaround, if you cannot upgrade today, restrict the application to a VPN or an allow list.
- Review access logs for informacao_adicional.php and the other endpoints named in the related advisories.
- If the application holds personal or health records, treat any unexplained access as a possible data incident and follow your own breach process.
- Rotate database credentials and application passwords if you cannot rule out misuse.
Why it matters
The weaknesses here are CWE-284 (improper access control) and CWE-89 (SQL injection). The code builds a database statement by joining a request value into the text, so the database cannot tell the developer's SQL from what the visitor sent. The advisory warns of reading sensitive data, and says an attacker could damage tables and, in some conditions, upload files.
The score of 9.8 comes from a network reachable flaw that needs no login and no user action, with high impact on confidentiality, integrity and availability. WeGIA is used by institutions that handle records about people, so the data at risk is personal. The record says no exploitation in the wild is confirmed: it is not in the CISA Known Exploited Vulnerabilities catalog.
The same developer pattern, a request value joined into a query, appears across many WeGIA files. A static scan finds it, and reachability analysis helps you see which of those files are actually exposed in your deployment.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-26606?
The GitHub advisory names 3.2.13 as the patched version. Moving to the latest WeGIA release covers this and the related WeGIA advisories.
Is there a workaround?
The advisory says there are no known workarounds. Restricting network access to the application reduces exposure until you upgrade, but it does not fix the flaw.
Sources
Check your own dependencies and apps with the free in-browser scan.
Last reviewed: 19 October 2026.
