The vulnerability is a host header injection flaw that allows an attacker to alter the Host header value sent to HCL Digital Experience and Digital Experience Compose. This manipulation can cause the application to process requests in unexpected ways, indicating that user‑controlled input is used as a header value without proper validation.

The affected products are HCL Software’s Digital Experience platform and the HCL Digital Experience Compose application. No specific version ranges are disclosed, so all versions of these products may be impacted until the vendor releases an update.

With a CVSS score of 6.1 the vulnerability is considered moderate, and the EPSS score is not available. It is not listed in the CISA KEV catalog. The likely attack vector is a remote web‑based interaction; an attacker can send a crafted HTTP request with a manipulated Host header to the application. In the absence of input validation, the application may treat the forged header as legitimate, leading to the unexpected behavior described above. The exploitation requires only the ability to influence HTTP headers over the network and does not need elevated privileges or user interaction beyond normal web traffic.