Based on the description, the vulnerability involves incorrect permission assignments for a critical resource in Owl opds, a weakness classified as CWE‑732. An attacker can send a specifically crafted network request to modify or delete files on the affected system. This can compromise the confidentiality, integrity, or availability of the system’s file store.

Based on the information presented, the vulnerability affects Owl CyberDefense Opds, specifically version 2.2.0.4. Other product variants are mentioned, but only 2.2.0.4 is confirmed to be affected.

The CVSS score of 6.8 indicates moderate severity, while the EPSS score of less than 1 % suggests a very low likelihood of exploitation at present. The vulnerability has not been reported in the CISA Known Exploited Vulnerabilities catalog, implying the absence of confirmed public exploits. Attackers are likely to target the Opds service over the network, and a crafted malicious request would allow remote manipulation of files. The attack vector is inferred to be remote network-based. If the system is exposed to untrusted networks, the risk is higher; isolating the service or limiting its exposure can reduce the attack surface.