CVE-2025-35112: Agiloft XML external entity local path traversal

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-26 · updated 2026-06-17
Weakness: CWE-611

Description

Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attacker to import the template file and perform path traversal on the local system files. Users should upgrade to Agiloft Release 31.

Affected products

Agiloft: from 19 before 31 — fixed in 31

How to fix

Upgrade to a fixed version: Agiloft 31. Check the vendor advisory for mitigations.

References

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-239-01.json
https://wiki.agiloft.com/display/HELP/What%27s+New%3A+CVE+Resolution
https://www.cve.org/CVERecord?id=CVE-2025-35112

Get alerted when CVE-2025-35112 or the next vulnerability affects your stack