by Kastro
Paper/Archive/CVE-2025-27531

CVE-2025-27531

Apache Software Foundation Apache InLong — Apache InLong: An arbitrary file read vulnerability for JDBC

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.1.551 × 2011.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Deserialization of Untrusted Data vulnerability in Apache InLong.  This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an authenticated attacker to read arbitrary files by double writing the param. Users are recommended to upgrade to version 2.1.0, which fixes the issue.

Affected

ProductAffectedFixed inSource
Apache InLong1.13.0 – < 2.1.02.1.0CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread/r62lkqrr739wvcb60j6ql6q63rh4bxx5refopenwall.com/lists/oss-security/2025/02/28/2