The vulnerability occurs because HCL AION parses untrusted files outside of a properly isolated sandbox. This flaw can be exploited by sending specially crafted files that may alter application state or data, leading to integrity violations. The CVSS score of 4.7 indicates a medium-low severity, and the description only references integrity impact without mentioning confidentiality or availability disruption.

All versions of HCL AION are potentially affected; the CVE data does not specify particular release numbers. Administrators should assume that any installed instance of AION could be vulnerable until an official patch is released.

The EPSS score is less than 1%, suggesting that real-world exploitation is rare at this time. HCL AION is not listed in the CISA KEV catalog, which reinforces the low likelihood of widespread attacks. The attack vector is not explicitly documented; it is inferred that the flaw could be triggered by a local or network-based file ingestion service that accepts untrusted input. The overall risk is moderate, given the low EPSS but the potential for integrity compromise if the flaw is exploited.