CVE-2025-35112CWE-611

Agiloft XML external entity local path traversal

Medium · published August 26, 2025

CVSS v4.0
5.1
EPSS
0%
Percentile
22.2
In the wild
Unconfirmed
What it is

Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attacker to import the template file and perform path traversal on the local system files. Users should upgrade to Agiloft Release 31.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00306 · 22.2th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2025-08-26T22:19Z
EPSS history
Timeline
  • 26 AUG 22:19Z
    Agiloft XML external entity local path traversal
    cvelistv5