HCL BigFix AEX contains a vulnerability that allows an attacker to upload arbitrary files without validation and to subsequently read or download those files without proper authorization. The issue arises from unrestricted file upload support combined with improper access control on the uploaded content, enabling an attacker to place and retrieve malicious data. This flaw could lead to the delivery of executable code, the compromise of the application environment, or the exposure of confidential information.

The affected product is HCL Software BigFix AEX. No specific version constraints are listed, so any releases of BigFix AEX could be impacted unless the vendor specifies otherwise in its advisory.

The CVSS score of 8.6 indicates high severity, reflecting a substantial impact if exploited. Although the EPSS score is not available, the lack of a KEV listing does not diminish the threat; the vulnerability can still be actively targeted. The likely attack path involves an authenticated user accessing the web portal, uploading a file through the exposed endpoint, and then retrieving that file to trigger further exploitation. The combination of inadequate file type restrictions and weak permission checks creates a favorable environment for attackers to both compromise the system and exfiltrate data.