An uncontrolled search path element flaw in Owl Cyberdefense Opds version 2.2.0.4 lets an attacker craft a network request that manipulates configuration file search paths. The weakness, identified as CWE‑427, can be abused to cause the system to load and execute arbitrary code with the privileges of the Owl Opds process. This grants the attacker remote code execution capability, potentially compromising the entire host and any network services it supports.

The affected products are Owl Cyberdefense Opds, specifically the 2.2.0.4 release and earlier 2.2.0.x series. Earlier releases labeled opds‑100 and opds‑1000 are also listed in the CPE data and are likely impacted as they share the same code base.

The vulnerability carries a CVSS score of 8.4, indicating high severity. The EPSS score is below 1 %, suggesting a low current exploitation probability. It is not yet indexed in CISA’s KEV list. The attack vector appears to be network‑based, requiring the attacker to send a specially crafted request to the vulnerable Opds instance. Exploitation would require network access to the Opds service and no user interaction; thus, once the vulnerability is present, remote attackers can likely abuse it in a suitable environment.