CVE-2025-60012

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-60012
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-60012.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-60012
Aliases
Published
2026-03-13T19:53:52.530Z
Modified
2026-04-10T05:33:32.783349Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
[none]
Details

Malicious configuration can lead to unauthorized file access in Apache Livy.

This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later.

A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to files they do not have permissions to.

For the vulnerability to be exploitable, the user needs to have access to Apache Livy's REST or JDBC interface and be able to send requests with arbitrary Spark configuration values.

Users are recommended to upgrade to version 0.9.0 or later, which fixes the issue.

References

Affected packages

Git / github.com/apache/incubator-livy

Affected ranges

Type
GIT
Repo
https://github.com/apache/incubator-livy
Events
Introduced
664503355d8bae763989ebac087122e306239d54
Fixed
7215f209b25b96488189567807eaded00953a492
Database specific 
{
    "versions": [
        {
            "introduced": "0.7.0"
        },
        {
            "fixed": "0.9.0"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-60012.json"