The vulnerability is a server‑side request forgery that permits an attacker to supply an arbitrary UNC path in the file Prefix parameter of the OpenEventEvidenceFile.do endpoint. Because the DLP server attempts to open the supplied path, Windows resolves the host name and initiates SMB authentication to that host, exposing the server to unintended network traffic and the attacker’s control.

The affected products are Trellix DLP on‑prem extensions version 11.13.1 and all earlier releases.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in CISA KEV. An attacker would need to send a crafted request to the vulnerable endpoint, typically from the internal network, and must be able to reach the host on which the DLP service is running. Exploitation would cause the server to connect to an attacker‑controlled SMB host, which could lead to data exfiltration or further lateral movement.