HCL AION can expose internal server file system paths in certain application responses. This data leak allows an attacker to learn the exact directory layout of the application, which could facilitate targeted attacks or further exploitation. The weakness is classified as an information disclosure (CWE‑200) and represents a breach of confidentiality, potentially leading to unintended behavior or more serious system compromise under specific circumstances.

All deployments of HCL AION from HCL Software are potentially vulnerable. No specific product versions are listed, so every instance of the application should be treated as at risk until a fix is applied.

The CVSS score of 3.1 indicates a low severity impact. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation. The attack vector appears to be through normal application responses and can be executed by an attacker who can send requests to the affected service.