GHSA-62gc-8jr5-x9pm

Apache InLong Deserialization of Untrusted Data Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2025-27531

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.inlong:inlong-manager	>= 1.13.0, < 2.1.0	2.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an authenticated attacker to read arbitrary files by double writing the param. Users are recommended to upgrade to version 2.1.0, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-27531 advisory
https://github.com/apache/inlong/issues/11585 web
https://github.com/apache/inlong/pull/11586 web
https://github.com/apache/inlong/commit/ebcd6d3230b73abdc41edb93619be2a26c9b8c97 web
https://github.com/apache/inlong package
https://lists.apache.org/thread/r62lkqrr739wvcb60j6ql6q63rh4bxx5 web
http://www.openwall.com/lists/oss-security/2025/02/28/2 web