Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows import/export, allowing an authenticated attacker to import the template file and perform path traversal on the local system files. Users should upgrade to Agiloft Release 31.
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Agiloft | Atlassian | 19 (including) | 31 (excluding) |