CVE-2025-27531

Published: Jun 6, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an authenticated attacker to read arbitrary files by double writing the param. Users are recommended to upgrade to version 2.1.0, which fixes the issue.

Affected (1)

Products: Apache: Inlong

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Inlong	From 1.13.0 to 2.1.0

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://lists.apache.org/thread/r62lkqrr739wvcb60j6ql6q63rh4bxx5

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2025/02/28/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

Timeline

No history available yet.