CVE-2025-27140 is a Critical (CVSS 9.8) OS command injection in WeGIA, in the importar_dump.php endpoint. Version 3.2.15 contains the patch. Upgrade to 3.2.15 or later, and review the web directory for files you do not recognise. Take a backup first.
What's affected
Affected: WeGIA versions before 3.2.15. Fixed: 3.2.15, per the record and the project's GitHub advisory GHSA-xw6w-x28r-2p5c.
The weak spot is the importar_dump.php endpoint, in the code that handles a database dump import. The record explains that the command involved moves a temporary file, and that uploading a web shell is therefore also possible.
The same project had a separate SQL injection fixed in 3.2.14, covered in CVE-2025-27096. If you are on anything older than 3.2.15, one upgrade covers both.
How to check if you're exposed
Find your deployment and version:
find /var/www -name importar_dump.php 2>/dev/null
git -C /var/www/html/WeGIA describe --tags 2>/dev/null
Adjust the path to your install. Anything below 3.2.15 is affected.
Because the record says a web shell upload is possible, check for compromise on any instance that was exposed. Look for recently added or modified PHP files in the web root and for odd entries in the web logs for the import endpoint:
find /var/www -name "*.php" -mtime -60 2>/dev/null | head -30
grep "importar_dump" /var/log/apache2/access.log | head -30
Compare the file list against your last known good copy or deployment.
What to do now
- Identify every WeGIA instance and version.
- Upgrade to 3.2.15 or later.
- Before and after, take backups and compare file listings so you can spot unknown files.
- Restrict access to the application's administrative paths to trusted networks.
- Check the web root for unexpected PHP files and the logs for requests to
importar_dump.php. - If you find a web shell, treat the server as compromised: isolate it, rebuild from clean media, and rotate every secret that was on it.
Why it matters
The record lists CWE-284 (improper access control) and CWE-78 (OS command injection). The code assembles a shell command from input and runs it, and the endpoint is reachable without sufficient access checks, so a remote visitor can influence what the server runs.
The vector is network based, low complexity, no privileges, no user interaction, with high impact in all three areas. That combination is why the score is 9.8. The record notes that the command moves a temporary file, so file uploads of scripts are a natural follow on. The record's KEV flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog.
For small teams the best protection is quick upgrades plus limiting who can reach the application. An internal tool should not be open to the whole internet.
Quick check
Which version fixes the issue?
WeGIA 3.2.15 contains the patch, according to the record.
How do I know if someone placed a web shell?
Look for unfamiliar or recently changed PHP files in the web root and for odd requests to the import endpoint in the logs. Compare with a known good copy.
Sources
Last reviewed: 19 October 2026.
