CVE-2025-35113: Agiloft improper neutralization in EUI template engine

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-26 · updated 2026-06-17
Weakness: CWE-1336

Description

Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieve remote code execution by loading a specially crafted payload. Users should upgrade to Agiloft Release 31.

Affected products

Agiloft: from 19 before 31 — fixed in 31

How to fix

Upgrade to a fixed version: Agiloft 31. Check the vendor advisory for mitigations.

References

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-239-01.json
https://wiki.agiloft.com/display/HELP/What%27s+New%3A+CVE+Resolution
https://www.cve.org/CVERecord?id=CVE-2025-35113

Get alerted when CVE-2025-35113 or the next vulnerability affects your stack