Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

Apache InLong allows authenticated attackers to read arbitrary files.

CVE-2025-27531 · published 1 year ago
Summary

Apache InLong, a data integration tool, has a security flaw that lets an authorized user access and read files they shouldn't be able to. This happens when the user inputs specific data in a certain way. To fix this, update to version 2.1.0 or later.

What to do
  • Update apache org.apache.inlong:inlong-manager to version 2.1.0.
  • Update apache inlong to version 2.1.0 or later.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.inlong:inlong-manager >= 1.13.0, < 2.1.0
Fix: upgrade to 2.1.0
– apache inlong >= 1.13.0, < 2.1.0
cpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*
Original advisory text
Deserialization of Untrusted Data vulnerability in Apache InLong.  This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an authenticated attacker to read arbitrary ...
Deserialization of Untrusted Data vulnerability in Apache InLong. 

This issue affects Apache InLong: from 1.13.0 before 2.1.0,

this issue would allow an authenticated attacker to read arbitrary files by double writing the param.





Users are recommended to upgrade to version 2.1.0, which fixes the issue.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
8.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published6 Jun 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-62gc-8jr5-x9pm · GHSA
CVE-2025-27531 · NVD
Track software like this
Free during beta