The flaw is in ANTLR4’s getImportedVocabFile function, where the supplied grammar option can reference files outside the intended directory. An attacker can craft a request that causes the runtime to resolve an absolute or relative file path, allowing traversal of the file system. The vulnerability can be exercised remotely, enabling the attacker to read arbitrary files on the host that runs ANTLR4. This presents a moderate threat to confidentiality as sensitive configuration or source files may be disclosed. The weakness is a classic CWE‑22 style path traversal.

The issue affects the ANTLR4 grammar parser shipped by the antlr project, specifically versions up to and including 4.13.2. Any installation that uses the tokenVocab Grammar Option Handler and has the ability to accept external grammar definitions is susceptible. Exact version numbers beyond 4.13.2 are not listed; it is presumed that later releases have addressed the issue.

The CVSS score of 6.9 indicates moderate overall risk, with remote attack capabilities and the ability to read arbitrary files. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no current known exploitation campaigns. Attackers can exploit the flaw from a remote host that can send a crafted grammar definition; no local privilege escalation is required. The lack of a vendor‑issued fix underscores the importance of immediate remediation through upgrading or other mitigations.