IBM Aspera Shares versions 1.9.9 through 1.11.0 contain an HTTP header injection flaw caused by improper validation of the HOST header. The injected header content is reflected in HTTP responses, enabling attackers to inject malicious scripts, poison caches, or hijack user sessions. This weakness is an example of CWE‑644 – Unvalidated Input, and it can compromise the confidentiality, integrity, and availability of the application by exposing or altering user data and impersonating legitimate users.

The affected product is IBM Aspera Shares running on Windows and Linux. Vulnerable releases include 1.9.9, 1.10.x, and 1.11.0, as identified by the CPE entries. IBM has addressed the flaw in release 1.11.1, which can be downloaded from IBM Fix Central for the respective operating systems.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1 percent suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers only need to send a crafted HTTP request containing a malicious HOST header to the target server; no special privileges are required. Successful exploitation could enable cross‑site scripting, cache poisoning, or session hijacking to compromise user accounts and data.