CVE-2025-26608 is a Critical SQL injection flaw (CVSS 9.8) in the WeGIA web manager, in the dependente_docdependente.php endpoint. Versions up to 3.2.11 are listed as affected. Upgrade to 3.2.13 or later, which the advisory names as the fix. The advisory lists no workarounds.
What's affected
- Product: WeGIA, an open source web manager for institutions, with a focus on Portuguese language users
- Affected: versions up to and including 3.2.11 per the GitHub advisory
- Endpoint: dependente_docdependente.php (POST request on the employee dependent pages)
- Parameter: id_dependente and id_doc
- Fixed: 3.2.13
WeGIA publishes a run of closely related advisories from the same report. Several were fixed in 3.2.13 and the command injection and a few SQL injection fixes landed in 3.2.14. If you are on anything older than 3.2.14, upgrade to the latest release rather than picking one fix.
The advisory makes the same point about the session check: the redirect exists, but nothing ends the script, so a visitor who is not signed in can still reach the query.
How to check if you're exposed
WeGIA is deployed as an application on a PHP server, so the version is the version of the release you installed. If you installed from the project repository, check the tag:
git -C /path/to/WeGIA describe --tags
# confirm the endpoint exists in your copy
find /path/to/WeGIA -name "dependente_docdependente.php"
If the tag is 3.2.11 or earlier, you are affected. If you downloaded a release archive, compare the release label with the numbers above and read the advisory for your version. Check your web server access logs for requests to dependente_docdependente.php with unusual values in the id_dependente and id_doc parameter, going back to before the advisory was published on 16 February 2025.
What to do now
- Back up the application files and database, then upgrade WeGIA to the latest release. At minimum, reach 3.2.13.
- Because there is no workaround, if you cannot upgrade today, restrict the application to a VPN or an allow list.
- Review access logs for dependente_docdependente.php and the other endpoints named in the related advisories.
- If the application holds personal or health records, treat any unexplained access as a possible data incident and follow your own breach process.
- Rotate database credentials and application passwords if you cannot rule out misuse.
Why it matters
The weaknesses here are CWE-284 (improper access control) and CWE-89 (SQL injection). The code builds a database statement by joining a request value into the text, so the database cannot tell the developer's SQL from what the visitor sent. The advisory warns of reading sensitive data, and says an attacker could damage tables and, in some conditions, upload files.
The score of 9.8 comes from a network reachable flaw that needs no login and no user action, with high impact on confidentiality, integrity and availability. WeGIA is used by institutions that handle records about people, so the data at risk is personal. The record says no exploitation in the wild is confirmed: it is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Which version fixes CVE-2025-26608?
The GitHub advisory names 3.2.13 as the patched version. Moving to the latest WeGIA release covers this and the related WeGIA advisories.
Is there a workaround?
The advisory says there are no known workarounds. Restricting network access to the application reduces exposure until you upgrade, but it does not fix the flaw.
Sources
Check your own dependencies and apps with the free in-browser scan.
Last reviewed: 19 October 2026.
