Read the docs
TI-2025-37389 Aliases CVE-2025-60012GHSA-hm8x-rpgg-7855

Apache Livy: Restrict file access

Priority LOW 29CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to files they do not have permissions to. For the vulnerability to be exploitable, the user needs to have access to Apache Livy's REST or JDBC interface and be able to send requests with arbitrary Spark configuration values. Users are recommended to upgrade to version 0.9.0 or later, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00497 42nd percentileScored 2026-11-07
Fix Fixed Apache Livy (Apache Software Foundation): 0.9.0-incubatingorg.apache.livy:livy-server (Maven): 0.9.0-incubating

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Livy0.7.0-incubating to before 0.9.0-incubating0.9.0-incubatingPatch availableCNA
—org.apache.livy:livy-server (Maven)0.7.0-incubating to before 0.9.0-incubating0.9.0-incubatingPatch availableGHSA-hm8x-rpgg-7855
  • Apache Livy VendorApache Affected 0.7.0-incubating to before 0.9.0-incubating Fixed in 0.9.0-incubating Patch available CNA
  • org.apache.livy:livy-server (Maven) Vendor— Affected 0.7.0-incubating to before 0.9.0-incubating Fixed in 0.9.0-incubating Patch available GHSA-hm8x-rpgg-7855

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:livy:*:*:*:*:*:*:*:*0.7.0 to before 0.9.0VulnerableApache
  • cpe:2.3:a:apache:livy:*:*:*:*:*:*:*:* Versions 0.7.0 to before 0.9.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Livy (Apache Software Foundation) Fixed in 0.9.0-incubating
  • Fix · GHSA-hm8x-rpgg-7855 org.apache.livy:livy-server (Maven) Fixed in 0.9.0-incubating Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Livy 0.9.0-incubating

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-40731 Apache Livy: Unauthorized directory accessPriority LOW 29
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-60012
  2. 2026-10-03 Alias added: GHSA-hm8x-rpgg-7855

References

Advisory 3

Other 1

  • TI-2021-08276 Apache Livy (Incubating) is vulnerable to cross site scripting CVSS 3.1MEDIUM 5.4
  • TI-2025-40731 Apache Livy: Unauthorized directory access CVSS 3.1MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences