Progress MarkLogic Server releases 12.x before 12.1.0 and 11.x before 11.3.7 contain legacy InfoStudio modules that lack proper validation of user‑controlled file paths and user‑context values. This flaw is a classic path traversal (CWE-22) coupled with incorrect privilege handling (CWE-269), enabling an attacker to read or modify server files and to execute operations under an unintended identity. The resulting impact would be unauthorized data disclosure and potential escalation of privileges within the database environment.

The vulnerable product is Progress Software Corporation MarkLogic Server. Versions affected are any 12.x releases earlier than 12.1.0 and any 11.x releases earlier than 11.3.7. All systems running these releases should be considered at risk.

With a CVSS score of 8.5 the vulnerability is classified as high severity. The EPSS score is not available, indicating that recent data does not provide a numeric probability, and the vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires authenticated access to the legacy InfoStudio modules; an attacker with such access could trick the application into opening any server file or executing code as a higher‑privilege user, as the modules do not enforce strict path or context validation.