This vulnerability involves a Confused Deputy flaw (CWE-610) in the EmailTask component of Google Cloud Application Integration. Authenticated attackers could exploit this flaw by providing a crafted attachment file path, enabling them to read and exfiltrate arbitrary internal files within Google's infrastructure. The issue affects versions of the product prior to the patch date of 2026-06-30. The vendor has released a patch on that date, and the service is cloud-hosted, with Google managing remediation.

An authenticated attacker with access to the Application Integration service could read and exfiltrate arbitrary internal files within Google's infrastructure, potentially exposing sensitive internal data. The CVSS v4.0 score is 8.3 (high severity), reflecting the network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and system control.

This vulnerability was patched by Google on June 30, 2026. As this is a cloud-hosted service, Google manages the remediation server-side, and no customer action is required according to the vendor advisory.