The vulnerability permits recursive directory copying without proper controls, which can inadvertently include sensitive or unnecessary files in the copy set. This expands the attack surface and permits an attacker to read data that should not be publicly accessible, potentially exposing confidential information. The weakness matches access control flaws (CWE-552).

IBM Concert Software, versions 1.0.0 through 3.0.0 are affected. Any deployment of these versions, including containerized releases, is subject to the risk.

The CVSS score of 6.2 indicates moderate severity. Exploitation requires the ability to initiate copy operations within the IBM Concert environment; the description does not specify a remote vector, so it is likely limited to users who can use the application. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation, but the lack of controls still warrants prompt remediation.