CVE-2025-52642

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour. Exposure of internal paths may reveal environment structure details which could potentially aid in further targeted attacks or information disclosure.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-538

Affected software

No affected versions have been published.

Timeline

Published: Mar 16, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-526437.8HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environm CVE-2025-526448.2HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged. The absence of proper auditing mech CVE-2025-526455.3HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verificati CVE-2025-526465.3HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Impro CVE-2025-526476.1The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning Attacks CVE-2025-526489.8HCL AION is affected by a vulnerability where offering images are not digitally signed. Lack of image signing may allow the use of unverifie CVE-2025-526495.3HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature. Predictable identifiers may allow an attacke CVE-2025-52654.8Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this comman CVE-2025-526506.1Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0 CVE-2025-526513.5HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system beh CVE-2025-526523.5HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as CVE-2025-526535.4HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the execution of unauthorize