CVE-2026-13503 is a path traversal vulnerability affecting the getImportedVocabFile function in the TokenVocabParser.java file of ANTLR4 up to version 4.13.2. The issue allows remote attackers to manipulate file paths to access files outside the intended directory scope. The vulnerability is confirmed in versions 4.13.0, 4.13.1, and 4.13.2. The vendor has not responded to disclosure requests, and no official fix or mitigation has been published. The exploit is publicly available, increasing the risk of exploitation.

Successful exploitation of this vulnerability can lead to unauthorized file access on systems running affected ANTLR4 versions. This may expose sensitive information or configuration files. The vulnerability can be exploited remotely without authentication, increasing the attack surface. However, there is no indication of privilege escalation or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable component and monitor for any suspicious activity related to file access. Avoid exposing the vulnerable functionality to untrusted inputs or networks where possible.