The vulnerability allows a malicious actor to overwrite critical internal files during the import process, which can result in the execution of arbitrary code or the disclosure of sensitive data. The flaw arises from insufficient validation of imported file names and paths, permitting attackers to target files that the application has write access to. If exploited, an attacker could replace legitimate binaries, configuration files, or other essential components, thereby compromising the entire system that runs the application.

The affected product is DeftPDF Document Translator version 54.0. No other vendors or product versions are listed in the data, and the vulnerability is specific to the file import functionality of that version.

The CVSS score and EPSS are not provided, but the potential for arbitrary code execution is high. The vulnerability is likely exploitable via a user-controllable file import, and the lack of a countermeasure means that any user with access can trigger it. Because it is not listed in the CISA KEV catalog, there is no official record of widespread exploitation, yet the risk remains significant for any deployment of the affected version.