CVE-2025-55169
MEDIUM NUCLEIWeGIA < 3.4.8 - Path Traversal via Download Remessa Endpoint
Title source: llmExploitation Summary
CVE-2025-55169 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.
Description
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in the WeGIA application, html/socio/sistema/download_remessa.php endpoint. This vulnerability could allow an attacker to gain unauthorized access to local files in the server and sensitive information stored in config.php. config.php contains information that could allow direct access to the database. This issue has been patched in version 3.4.8.
Nuclei Templates (1)
WeGIA - Directory Traversal
CRITICALVERIFIEDby praivesi
FOFA:
title="WeGIA"
References (3)
Core 3
Core References
Exploit, Vendor Advisory x_refsource_confirm
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mm3p-7573-4x4j
Issue Tracking, Mitigation x_refsource_misc
https://github.com/LabRedesCefetRJ/WeGIA/issues/177
Scores
CVSS v3
6.5
EPSS
0.0188
EPSS Percentile
83.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-22
CWE-287
Status
published
Products (1)
wegia/wegia
< 3.4.8
Published
Aug 12, 2025
Tracked Since
Feb 18, 2026