Paper/Archive/CVE-2025-27528

CVE-2025-27528

Apache Software Foundation Apache InLong — Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read

EPSS 0.9%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 58.5.585 × 2011.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability allows attackers to bypass the security mechanisms of InLong JDBC and leads to arbitrary file reading. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11747

Affected

ProductAffectedFixed inSource

Apache InLong1.13.0 – 2.1.0–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread/b807rqzgyv4qgvxw3nhkq8tl6g90gqgj patchgithub.com/apache/inlong/pull/11747 refopenwall.com/lists/oss-security/2025/05/28/3