CVE-2025-27528
Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read
Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability allows attackers to bypass the security mechanisms of InLong JDBC and leads to arbitrary file reading. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11747
Reserved 2025-02-27 | Published 2025-05-28 | Updated 2025-05-28 | Assigner apacheCWE-502 Deserialization of Untrusted Data
yulat
m4x
h3h3qaq
lists.apache.org/thread/b807rqzgyv4qgvxw3nhkq8tl6g90gqgj
github.com/apache/inlong/pull/11747
Support options
