Remote Code Execution Vulnerability in Agiloft by Agiloft Inc.
CVE-2025-35113

4.8MEDIUM

Key Information:

Vendor

Agiloft

Status
Agiloft
Vendor
CVE Published:
26 August 2025

What is CVE-2025-35113?

A vulnerability in Agiloft Release 28 has been identified, where the application fails to properly neutralize special elements in its EUI template engine. This flaw enables authenticated attackers to execute arbitrary code remotely by crafting a malicious payload. To mitigate this issue, users are strongly advised to upgrade to Agiloft Release 31, which addresses this vulnerability effectively.

Affected Version(s)

Agiloft 0

Agiloft Release 31

References

https://wiki.agiloft.com/display/HELP/What%27s+New%3A+CVE...
https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...
https://www.cve.org/CVERecord?id=CVE-2025-35113

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matthew Galligan, CISA Rapid Action Force (RAF)
.
CVE-2025-35113 : Remote Code Execution Vulnerability in Agiloft by Agiloft Inc.