XML External Entities Vulnerability in Agiloft Software
CVE-2025-35112

5.1MEDIUM

Key Information:

Vendor

Agiloft

Status
Agiloft
Vendor
CVE Published:
26 August 2025

What is CVE-2025-35112?

Agiloft Release 28 contains a vulnerability that allows authenticated attackers to exploit XML External Entities (XXE). This is achieved through any table that permits import/export functionality, enabling attackers to import template files and execute path traversal attacks on local system files. Users are strongly advised to upgrade to Agiloft Release 31 to mitigate this risk.

Affected Version(s)

Agiloft 0

Agiloft Release 31

References

https://wiki.agiloft.com/display/HELP/What%27s+New%3A+CVE...
https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...
https://www.cve.org/CVERecord?id=CVE-2025-35112

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matthew Galligan, CISA Rapid Action Force (RAF)
.
CVE-2025-35112 : XML External Entities Vulnerability in Agiloft Software