The vulnerability resides in the ast_xml_open function within Asterisk's xml.c module, which employs libxml's XML_PARSE_NOENT option and processes XIncludes without restrictions. If an attacker supplies untrusted XML content, the parser expands entities and processes XInclude directives, enabling the retrieval of arbitrary local files from the host system. This results in sensitive file disclosure and potentially broader information compromise, consistent with CWE-611.

Asterisk PBX products identified by Sangoma's certified Asterisk releases, including versions prior to 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, are affected. The official CNA product name is asterisk:asterisk and all CPE entries corresponding to these products are vulnerable.

The CVSS base score of 2.0 indicates a low severity impact, and the EPSS score of less than 1% implies a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attack vector is user-supplied XML processed by Asterisk; it requires the attacker to supply malicious XML data, which is typically possible through configuration files or inbound XML messages, but no widespread public exploits have been reported.