lxml, a Python library for XML and HTML processing, has a default configuration that sets the resolve_entities flag to True. This causes the XML parser to expand external entities, allowing untrusted XML input to read arbitrary local files. The weakness is a classic XML External Entity (XXE) flaw, classified as CWE-611, and can lead to sensitive data exposure. The vulnerability is triggered when an attacker supplies crafted XML to the iterparse() or ETCompatXMLParser() APIs.

Any system that uses the lxml library in a version prior to 6.1.0 is affected. The lack of explicit version constraints in the data implies that all releases before 6.1.0 are vulnerable. The issue applies to both iterparse() and ETCompatXMLParser() functions within the lxml package.

The CVSS score for this vulnerability is 7.5, indicating a high severity. The EPSS score is reported as less than 1%, implying a very low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the injection of untrusted XML documents into any feature of a Python application that relies on the default lxml configuration. If an attacker can supply such XML, they could read sensitive files from the host system, compromising confidentiality.