CVE-2025-26613

Summary

CVE-2025-26613 is a newly discovered OS Command Injection vulnerability affecting the open-source Portuguese language Web Manager for Institutions, WeGIA. The vulnerability resides in the `gerenciar_backup.php` endpoint of the application, enabling an attacker to execute arbitrary code remotely. This issue poses a significant threat, as successful exploitation could lead to serious compromise. To mitigate this risk, WeGIA users are strongly urged to upgrade to version 3.2.14. At present, there are no known workarounds for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.