The vulnerability allows an attacker to gather insights into the structure of the internal filesystem. Exposing such details can reveal configuration files, directory layouts, and other artefacts that may facilitate future targeted attacks. The primary consequence is information disclosure, potentially aiding the planning or execution of more damaging exploits.

HCL AION is the only product affected. No specific version information is listed, so all current releases of HCL AION should be evaluated for this issue.

The CVSS score of 2.9 indicates low severity, and the EPSS score is 0.00011, indicating an extremely low exploitation probability. The vulnerability is not listed in the CISA KEV catalogue. Based on the description, the likely attack vector is local or requires privileged access to the system, as the exploitation involves interacting with internal filesystem structures. Since the CVE description does not mention remote code execution or network access, we infer that an attacker would need to compromise a local account or execute an action that triggers the vulnerable system behaviour.