CVE-2025-50201

Description

WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, an OS Command Injection vulnerability was identified in the /html/configuracao/debug_info.php endpoint. The branch parameter is not properly sanitized before being concatenated and executed in a shell command on the server's operating system. This flaw allows an unauthenticated attacker to execute arbitrary commands on the server with the privileges of the web server user (www-data). This issue has been patched in version 3.4.2.

Reserved 2025-06-13 | Published 2025-06-19 | Updated 2025-06-19 | Assigner GitHub_M

Problem types

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

< 3.4.2
affected

References

github.com/.../WeGIA/security/advisories/GHSA-52p5-5fmw-9hrf

github.com/...ommit/45f32ad1d52775fc99f3c90075c8136c6d4d1d3d

cve.org (CVE-2025-50201)

nvd.nist.gov (CVE-2025-50201)

Download JSON