CVE-2025-27531

critical · 9.8

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an authenticated attacker to read arbitrary files by double writing the param. Users are recommended to upgrade to version 2.1.0, which fixes the issue.

9.8

CVSS

0.7%

EPSS (exploit prob.)

50th

EPSS percentile

2025-06-06

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-502

Affected products

Vendor	Product	Affected versions
apache	inlong	>= 1.13.0, < 2.1.0

Check a specific version with /api/v1/cve/match.

References

https://lists.apache.org/thread/r62lkqrr739wvcb60j6ql6q63rh4bxx5
http://www.openwall.com/lists/oss-security/2025/02/28/2

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-27531