CVE-2025-35112

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-35112
Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attacker to import the template file and perform path traversal on the local system files. Users should upgrade to Agiloft Release 31.

4.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-239-01.json Third Party Advisory
https://wiki.agiloft.com/display/HELP/What%27s+New%3A+CVE+Resolution Release Notes Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2025-35112 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:atlassian:agiloft:*:*:*:*:*:*:*:*
History

02 Sep 2025, 17:59

Type Values Removed Values Added
First Time Atlassian agiloft
Atlassian
References () https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-239-01.json - () https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-239-01.json - Third Party Advisory
References () https://wiki.agiloft.com/display/HELP/What%27s+New%3A+CVE+Resolution - () https://wiki.agiloft.com/display/HELP/What%27s+New%3A+CVE+Resolution - Release Notes, Vendor Advisory
References () https://www.cve.org/CVERecord?id=CVE-2025-35112 - () https://www.cve.org/CVERecord?id=CVE-2025-35112 - Third Party Advisory
CPE cpe:2.3:a:atlassian:agiloft:*:*:*:*:*:*:*:*

29 Aug 2025, 16:22

Type Values Removed Values Added
Summary
  • (es) Agiloft Release 28 contiene una vulnerabilidad de entidades externas XML en cualquier tabla que permita la importación/exportación, lo que permite a un atacante autenticado importar el archivo de plantilla y realizar path traversal en los archivos del sistema local. Los usuarios deben actualizar a Agiloft Release 31.

26 Aug 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-26 23:15

Updated : 2025-09-02 17:59

NVD link : CVE-2025-35112

Mitre link : CVE-2025-35112

CVE.ORG link : CVE-2025-35112

JSON object : View

Products Affected

atlassian

  • agiloft
CWE
CWE-611

Improper Restriction of XML External Entity Reference