PT-2025-23053

CVE-2025-27528

Published

2025-02-11

Updated

2025-06-02

Description by

CVSS 2.0

9.4

Critical

MetricsAV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.13.0 through 2.1.0

Description The issue affects Apache InLong, allowing attackers to bypass its security mechanisms and enabling arbitrary file reading due to a deserialization of untrusted data vulnerability.

Recommendations For Apache InLong versions 1.13.0 through 2.1.0, update to version 2.2.0 to resolve the issue. Alternatively, users can cherry-pick the solution from the provided GitHub pull request.

Exploitability

Fix

Impacts

Researchers

H3H3Qaq

Yulat

Vendors

Affected products

Weakness enumeration

CWE-502: Deserialization of Untrusted Data

Related identifiers

CVE-2025-27528