CVE-2026-63043: Apache InLong: Agent path traversal via unvalidated file source path

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-20 · updated 2026-10-18
Weakness: CWE-23

Description

Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12146 .

Affected products

Apache Software Foundation Apache InLong: from 2.0.0 before 2.4.0 — fixed in 2.4.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache InLong 2.4.0. Check the vendor advisory for mitigations.

References

https://lists.apache.org/thread/0ohn861tzd9g7nsosd6oz3of6dvhvqnk
http://www.openwall.com/lists/oss-security/2026/08/20/16

Get alerted when CVE-2026-63043 or the next vulnerability affects your stack