CVE-2025-27096 is a Critical (CVSS 9.8) SQL injection in WeGIA, a web manager for institutions, in the personalizacao_upload.php endpoint. The project fixed it in version 3.2.14 and says there are no workarounds. Upgrade to 3.2.14 or later and take a backup before you start.
What's affected
Affected: WeGIA versions before 3.2.14. Fixed: 3.2.14, according to the project's GitHub advisory GHSA-j856-wh9m-9vpm. The record states there are no known workarounds.
The weak spot is the id_campo parameter on the html/personalizacao_upload.php endpoint. The advisory notes there is no validation of user input in that code path.
There is a small mismatch worth knowing: the description says an authorized attacker, while the CVSS vector in the record lists no privileges required. The GitHub advisory scores it with privileges required as low. Because the sources disagree, plan as if any reachable instance could be at risk.
How to check if you're exposed
WeGIA is a PHP application deployed on your own server. Find the version in the application's about or footer text, or in the project files on disk:
find /var/www -name personalizacao_upload.php 2>/dev/null
The paths depend on how you installed it. If your copy is a git checkout, ask Git which tag you are on:
git describe --tags 2>/dev/null
Anything below 3.2.14 is affected. Review the web server log for requests to the endpoint that carry unusual values in the id_campo field, and review the database for unexpected changes.
What to do now
- Find every WeGIA installation and its version.
- Upgrade to 3.2.14 or later. The project lists no workaround.
- Take a database backup first, and test the upgrade on a copy.
- Until the upgrade is done, restrict access to the application to trusted networks.
- Check logs for odd requests to
personalizacao_upload.php. - Rotate application and database credentials if you find signs of misuse.
Why it matters
The record lists CWE-89. The code builds a SQL statement by joining in a request value, so the value can change the statement. The GitHub advisory shows the query shape and says input is not validated, which is the textbook case for prepared statements.
The advisory's impact list is retrieving sensitive data, deleting tables, and in some conditions uploading files. WeGIA is used by charitable institutions, which hold personal records about people in their care. Protecting that data is the practical reason to treat the score seriously. The record's KEV flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog.
Software for small institutions often runs without a security team behind it. Applying the update and limiting network exposure are the two actions that matter most.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a workaround?
The project says there are no known workarounds. Upgrade to 3.2.14 or later.
Do I need to be logged in to be at risk?
The sources disagree. The record's vector lists no privileges and the advisory says an authorized attacker. Assume any reachable instance may be at risk.
Sources
Last reviewed: 19 October 2026.
