Vulnerability in Agiloft
CVE-2025-35113
Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieve remote code execution by loading a specially crafted payload. Users should upgrade to Agiloft Release 31.
EPSS: 0.004 (35.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L.
Affected products
- Agiloft — versions 0, Release 31
- Atlassian Agiloft
Weakness classification (CWE)
References
- 9119a7d8-5eab-497f-8521-727c672e3725 (Release Notes, Vendor Advisory)
- 9119a7d8-5eab-497f-8521-727c672e3725 (Third Party Advisory)
- 9119a7d8-5eab-497f-8521-727c672e3725 (Third Party Advisory)
Frequently asked questions
- What is CVE-2025-35113?
- CVE-2025-35113 is a medium-severity vulnerability in Agiloft, classified under Improper Neutralization of Special Elements Used in a Template Engine. CVSS score: 5.9/10. Published 2025-08-26.
- How severe is CVE-2025-35113?
- Medium severity. CVSS v3 base score is 5.9 out of 10.