Agiloft Remote Code Execution Vulnerability via EUI Template Injection

A remote code execution vulnerability has been identified in Agiloft Release 28. The issue arises from improper neutralization of special elements in the EUI template engine, allowing authenticated attackers to execute arbitrary code by loading a specially crafted payload. This vulnerability affects users with administrative permissions who can import and edit EUI templates.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server, with the executed code running in the context of the application.

Remediation

Users are advised to upgrade to Agiloft Release 31, which addresses this vulnerability by implementing safeguards that prevent unauthorized code execution through templates.