CVE-2026-63043

HighCVSS 7.5/10Last modified Oct 18, 2026

Description

Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem.

This issue affects Apache InLong: from 2.0.0 before 2.4.0.

Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.

[1]  https://github.com/apache/inlong/pull/12146 .

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-23

Affected software

No affected versions have been published.

Timeline

Published
Aug 20, 2026
Last modified
Oct 18, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-630445.4Server-Side Request Forgery (SSRF) vulnerability in Apache InLong.  Any authenticated user (no admin role required) can cause the InLong ManCVE-2026-630457.5Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platfoCVE-2026-630468.8Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleMCVE-2026-630477.5Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extensionCVE-2026-630489.4Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2 - The Joomla extension PaCVE-2026-63058.8Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandboxCVE-2026-63068.8Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandboxCVE-2026-63078.8Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox viaCVE-2026-630719.8Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for ImplementationsCVE-2026-630727.5Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrCVE-2026-630739.8Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERRCVE-2026-630745.9Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but neve
CVE-2026-63043: High severity, CVSS 7.5 | Vulnix