CVE-2025-60012 Apache Livy: Restrict file access
Attackers with REST or JDBC access can manipulate Spark configurations to read unauthorized files in Apache Livy.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-60012?
CVE-2025-60012 is a medium-severity path traversal vulnerability in Apache Livy, published on 13 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Malicious configuration can lead to unauthorized file access in Apache Livy.
This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later.
A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to files they do not have permissions to.
For the vulnerability to be exploitable, the user needs to have access to Apache Livy's REST or JDBC interface and be able to send requests with arbitrary Spark configuration values.
Users are recommended to upgrade to version 0.9.0 or later, which fixes the issue.
Weakness: CWE-20
Which versions are affected by CVE-2025-60012?
2 open source packages ship an affected version, including org.apache.livy:livy-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.livy:livy-server Maven | From 0.7.0-incubating | 0.9.0-incubating |
org.apache.livy:livy-server Maven | From 0.7.0-incubating | 0.9.0-incubating |
Products include Apache Livy.
How do I fix CVE-2025-60012?
Upgrade org.apache.livy:livy-server to 0.9.0-incubating or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-60012 being exploited?
There is no known exploitation of CVE-2025-60012 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apache Livy
Sources
Also known as GHSA-hm8x-rpgg-7855.