Agiloft XML External Entity Vulnerability Allowing Local Path Traversal

A vulnerability allowing XML External Entity (XXE) exploitation has been identified in Agiloft Release 28. This issue arises in tables that support 'import/export' functionality, where an authenticated attacker can import a template file that performs path traversal, accessing local system files. The vulnerability has been addressed in Agiloft Release 31.

Impact

Exploitation of this vulnerability could lead to unauthorized access to restricted files on the server, such as the /etc/passwd file, through external entity references in specially crafted XML files.

Remediation

Users are advised to upgrade to Agiloft Release 31, which resolves this vulnerability.