The vulnerability arises from an improper restriction of XML external entity (XXE) references. When a user supplies XML content to İmzager, the application processes the document and resolves external entities, which can lead to reading arbitrary files or receiving data from remote locations. This allows an attacker to perform serialized data external linking, potentially disclosing sensitive information or internal configuration data.

Affected systems include the TÜBİTAK BİLGEM Software Technologies Research Institute İmzager product, specifically all releases from 2.10.5 up to and including 2.10.6. Versions 2.10.7 and later are not affected. The vulnerability is tied to the XML parsing component used by the software.

The CVSS score of 3.3 classifies the issue as low severity. No EPSS score is reported, and it is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is either local or remote depending on how the application accepts XML input. If the processing is exposed through a network interface, a remote attacker could exploit the weakness by sending malicious XML, whereas a local attacker could supply crafted input via local access. The risk is limited to confidentiality and integrity of data processed by İmzager; denial of service is unlikely.