HCL AION is vulnerable to a disclosure of internal filesystem paths through application responses or system behavior. The information that can be exposed includes the server’s directory structure and other environmental details, which could help an attacker build a more precise attack plan or uncover sensitive configuration data. The weakness corresponds to the common weakness enumeration for information exposure.

The affected product is HCL AION. No specific version numbers were listed in the advisory, so all deployed instances of this solution may be impacted until HCL publishes a fix released in a newer version.

The defined CVSS score of 3.3 suggests low severity, and an EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not currently listed in CISA’s KEV catalog. Because the impact is limited to information disclosure, an attacker would need to generate responses that expose paths, possibly by sending crafted requests or triggering error messages. There is no direct path to code execution or denial of service from this flaw.