CVE-2024-26580: 
Java vulnerability analysis and mitigation

A Deserialization of Untrusted Data vulnerability was discovered in Apache InLong versions 1.8.0 through 1.10.0. The vulnerability was assigned CVE-2024-26580 and was disclosed on March 6, 2024. The vulnerability allows attackers to read arbitrary files from the system when they have access to the application (Apache Security).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The CVSS v3.1 base score is 9.1 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating that the vulnerability can be exploited remotely with low attack complexity and requires no privileges or user interaction (NVD Database).

When successfully exploited, the vulnerability allows attackers to read arbitrary files from the system, potentially exposing sensitive information and compromising system security (Apache Security).

The vulnerability requires a logged-in user to exploit, and attackers can use specific payloads to read arbitrary files from the system. The attack can be executed remotely, making it particularly dangerous for exposed systems (Apache Security).

Users are advised to upgrade to Apache InLong version 1.11.0 or apply the patch available through the provided cherry-pick solution. The fix is available in the GitHub pull request #9673 (Apache Security).