CVE-2026-63043 Apache InLong: Agent path traversal via unvalidated file source path

🗓️ 20 Aug 2026 15:53:11Reported by apacheType

Apache InLong Agent path traversal in versions 2.0.0 to 2.4.0 enables arbitrary file read.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2026-63043	20 Aug 202616:44	–	circl
CVE	CVE-2026-63043	20 Aug 202615:53	–	cve
EUVD	EUVD-2026-63475	20 Aug 202615:53	–	euvd
Mend	CVE-2026-63043	20 Aug 202615:53	–	mend
NVD	CVE-2026-63043	20 Aug 202616:17	–	nvd
Positive Technologies	PT-2026-79051	20 Aug 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-63043: Relative Path Traversal	20 Aug 202600:00	–	rapid7
vulnersOsv	org.apache.inlong:agent-docker (>=2.0.0, <=2.3.0), org.apache.inlong:agent-release (>=2.0.0, <=2.3.0) potentially affected by CVE-2026-63043 via org.apache.inlong:agent-plugins (>=2.0.0, <=2.3.0)	20 Aug 202615:53	–	vulnersosv
vulnersOsv	org.apache.inlong:agent-common (>=2.0.0, <=2.3.0), org.apache.inlong:agent-core (>=2.0.0, <=2.3.0) +103 more potentially affected by CVE-2026-63043 via org.apache.inlong:inlong-common (>=2.0.0, <=2.3.0)	20 Aug 202615:53	–	vulnersosv
vulnersOsv	org.apache.inlong:agent-core (>=2.0.0, <=2.3.0), org.apache.inlong:agent-docker (>=2.0.0, <=2.3.0) +3 more potentially affected by CVE-2026-63043 via org.apache.inlong:agent-common (>=2.0.0, <=2.3.0)	20 Aug 202615:53	–	vulnersosv

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache InLong",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.4.0",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/0ohn861tzd9g7nsosd6oz3of6dvhvqnk

20 Aug 2026 15:53Current

CVSS 3.17.5

EPSS0.00808

SSVC

CWE-23