Skip to content
OpenAdvisories
Critical · 9.8 CVE-2025-27531 EUVD-2025-17317GHSA-62gc-8jr5-x9pm

Apache InLong: An arbitrary file read vulnerability for JDBC

Published Jun 6, 2025 · Updated Jun 10, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache InLong Package: org.apache.inlong:inlong-manager Ecosystem: Maven

Description

Deserialization of Untrusted Data vulnerability in Apache InLong. 

This issue affects Apache InLong: from 1.13.0 before 2.1.0,

this issue would allow an authenticated attacker to read arbitrary files by double writing the param.

Users are recommended to upgrade to version 2.1.0, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache InLong 1.13.0 – < 2.1.0 2.1.0

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.inlong:inlong-manager >= 1.13.0, < 2.1.0 2.1.0 GHSA-62gc-8jr5-x9pm

References