What is GHSA-62gc-8jr5-x9pm?

GHSA-62gc-8jr5-x9pm is a security advisory published by GitHub Security Advisories with High severity. Apache InLong Deserialization of Untrusted Data Vulnerability

Which CVE IDs does GHSA-62gc-8jr5-x9pm cover?

GHSA-62gc-8jr5-x9pm covers the following CVE IDs: CVE-2025-27531. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-62gc-8jr5-x9pm?

GHSA-62gc-8jr5-x9pm has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-62gc-8jr5-x9pm?

GHSA-62gc-8jr5-x9pm affects 1 product, including: maven/org.apache.inlong:inlong-manager:\u003e= 1.13.0, \u003c 2.1.0.

GHSA-62gc-8jr5-x9pmHighCVSS 9.8

Apache InLong Deserialization of Untrusted Data Vulnerability

Vendor

GitHub Security Advisories

Published

June 6, 2025

Last Modified

June 10, 2025

🔗 CVE IDs covered (1)

CVE-2025-27531 →

📋 Description

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an authenticated attacker to read arbitrary files by double writing the param. Users are recommended to upgrade to version 2.1.0, which fixes the issue.

🎯 Affected products1

maven/org.apache.inlong:inlong-manager:>= 1.13.0, < 2.1.0

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2025-27531
https://lists.apache.org/thread/r62lkqrr739wvcb60j6ql6q63rh4bxx5
http://www.openwall.com/lists/oss-security/2025/02/28/2
https://github.com/apache/inlong/issues/11585
https://github.com/apache/inlong/pull/11586
https://github.com/apache/inlong/commit/ebcd6d3230b73abdc41edb93619be2a26c9b8c97
https://github.com/advisories/GHSA-62gc-8jr5-x9pm