CVE-2025-26613 is a Critical OS command injection flaw (CVSS 9.8) in the WeGIA web manager, in the gerenciar_backup.php endpoint. It could let an attacker run code remotely. Versions up to 3.2.13 are affected. Upgrade to 3.2.14 or later. The advisory lists no workarounds.
What's affected
- Product: WeGIA, an open source web manager for institutions, with a focus on Portuguese language users
- Affected: versions up to and including 3.2.13 per the GitHub advisory
- Endpoint: gerenciar_backup.php, the backup management page under the configuration area
- Parameter: file
- Fixed: 3.2.14
This differs from the SQL injection advisories published at the same time for WeGIA, most of which were fixed in 3.2.13. This one needed 3.2.14, so a system that was patched for the others can still be exposed to this issue.
The advisory describes the cause as a value from the request being placed into a shell command with no validation. It also says that the session check on the page redirects to the login page without ending the script, so the vulnerable code can still run for a visitor who is not signed in.
How to check if you're exposed
Find your release tag if you installed from the project repository:
git -C /path/to/WeGIA describe --tags
find /path/to/WeGIA -name "gerenciar_backup.php"
Anything below 3.2.14 is affected. Check web server access logs for requests to gerenciar_backup.php from addresses you do not recognise, and check the server for processes or files that you did not create, such as unexpected shells, new cron entries or new accounts. The advisory describes impact that includes information disclosure, a takeover of the web server and installation of malware, so a review of the host is a sensible step after any suspicious request.
What to do now
- Back up the application and database, then upgrade WeGIA to 3.2.14 or the latest release.
- If you cannot upgrade today, remove public access to the application. A VPN or an allow list reduces exposure. The advisory lists no workarounds that fix the flaw itself.
- Review access logs for gerenciar_backup.php since the advisory was published on 18 February 2025.
- Run the web server as an account with the least privileges you can, so a command that runs through the application has limited reach.
- If you find signs of a compromise, rebuild the host from a clean image rather than cleaning it, and rotate every credential the application could read.
Why it matters
The weaknesses listed are CWE-78 (OS command injection) and CWE-284 (improper access control). The core bug is OS command injection: the application passes a value from the request into a shell command, so the shell cannot tell which part the developer wrote and which part a visitor sent. That turns a web request into a way to run commands on the server, which is why this scores 9.8.
Command injection is more severe than the SQL injection in the same product, because it reaches the operating system and not only the database. From there an attacker can read files, including database credentials and records. The record does not say the flaw is exploited in attacks, and it is not in the CISA Known Exploited Vulnerabilities catalog. Reachability analysis helps you see whether a given code path is reachable in your deployment, but for a flaw that needs no login, the safe response is to patch.
Quick check
Does the 3.2.13 release fix CVE-2025-26613?
No. The advisory lists versions up to 3.2.13 as affected and names 3.2.14 as the patched version. Upgrade to 3.2.14 or later.
Is CVE-2025-26613 being exploited in the wild?
The record does not say so, and it is not in the CISA Known Exploited Vulnerabilities catalog. Because no login is needed per the CVSS vector, patch promptly anyway.
Sources
Check your own dependencies with the free in-browser scan.
Last reviewed: 19 October 2026.
