The vulnerability arises from improper neutralization of special elements used in expression language statements (SSTI). An attacker who can supply unsanitized input may inject code that is interpreted by the embedded expression engine, leading to arbitrary code execution within the Apinizer application. This compromises confidentiality, integrity, and availability of the hosted data. The weakness is classified as CWE-917.

Apinizer by Soagen Informatics Technologies Software and Consulting Inc. is vulnerable in versions starting with 2026.04.0 and prior to 2026.04.6. Any deployment of Apinizer within this range should be considered affected.

The CVSS score of 9.8 indicates a critical severity, and the vulnerability is not currently listed in the CISA KEV catalog. EPSS is not available, so the current exploitation probability cannot be quantified. Based on the description, the likely attack vector involves a user or attacker submitting a crafted expression to the application’s expression language interface, which then is executed with the system’s privileges. If the affected system exposes this functionality to external users, the risk of code execution is significant. The impact depends on the privileges assigned to the execution context, but could allow full control over the affected environment.