CVE-2025-27531

Description

Deserialization of Untrusted Data vulnerability in Apache InLong.  This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an authenticated attacker to read arbitrary files by double writing the param. Users are recommended to upgrade to version 2.1.0, which fixes the issue.

Reserved 2025-02-28 | Published 2025-06-06 | Updated 2025-06-06 | Assigner apache

Problem types

CWE-502 Deserialization of Untrusted Data

Product status

Default status
unaffected

1.13.0 before 2.1.0
affected

Credits

Ming finder

References

lists.apache.org/thread/r62lkqrr739wvcb60j6ql6q63rh4bxx5 vendor-advisory

cve.org (CVE-2025-27531)

nvd.nist.gov (CVE-2025-27531)

Download JSON