CVE-2025-35112

Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attacker to import the template file and perform path traversal on the local system files. Users should upgrade to Agiloft Release 31.

Score

CVSS 4.0 5.1 Medium

Status

Analyzed - 9119a7d8-5eab-497f-8521-727c672e3725

Published

2025-08-26

Last modified

2025-08-29

Weaknesses

CWE-611

Affected products

• Agiloft (Agiloft)
• Agiloft (Atlassian)

References

• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-239-01.json
• https://wiki.agiloft.com/display/HELP/What%27s+New%3A+CVE+Resolution
• https://www.cve.org/CVERecord?id=CVE-2025-35112