CVE-2025-35113CWE-1336

Agiloft improper neutralization in EUI template engine

Medium · published August 26, 2025

CVSS v4.0
4.8
EPSS
0%
Percentile
36.6
In the wild
Unconfirmed
What it is

Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieve remote code execution by loading a specially crafted payload. Users should upgrade to Agiloft Release 31.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L
EPSS
0.00434 · 36.6th percentile
Weakness
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine
Published
2025-08-26T22:17Z
EPSS history
Timeline
  • 26 AUG 22:17Z
    Agiloft improper neutralization in EUI template engine
    cvelistv5