The vulnerability stems from insufficient validation and sanitisation of user‑supplied input in TIBCO ActiveMatrix BusinessWorks and the Enterprise Administrator component. This flaw allows attackers to inject arbitrary content that the system processes, leading to disclosure of sensitive local files and host system details, and may also permit manipulation of application behaviour.

Vendors affected include TIBCO, specifically the ActiveMatrix BusinessWorks and Enterprise Administrator products. No specific version details are provided in the advisory, so the risk applies to any installations of these products that have not applied an available fix.

With a CVSS score of 8.7, the issue is considered High severity. The EPSS score indicates a low probability of exploitation (<1%), and the vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is via unsanitised user input supplied through exposed interfaces, which is inferred based on the description that injection allows disclosure and manipulation.