The vulnerability is a CWE-611 (XML External Entity) weakness that allows an attacker to supply XML data containing external entity references. Pentaho Data Integration and Analytics components do not block these references, enabling the attacker to read arbitrary files on the system, resulting in information disclosure. Based on the description, it is inferred that the XML parser may also consume excessive resources, potentially leading to denial-of-service. The attack does not require administrative credentials; it only requires the ability to submit XML documents to the affected service.

Affected systems are Hitachi Vantara Pentaho Data Integration and Analytics prior to version 10.2.0.7 and 11.0.0.0, including the 9.3.x and 8.3.x branches. These editions lack the configuration changes that disable external entity processing, leaving the XML subsystem vulnerable.

The CVSS score of 7.7 indicates a high impact with substantial exploitation potential. Since no EPSS metric is available and the vulnerability is not listed in the CISA KEV catalog, the current exploitation likelihood is uncertain but not negligible. The likely attack vector is an attacker supplying XML payloads to the Pentaho ETL or analytics service.