{"answers":{"affected":"2 open source packages ship an affected version, including org.apache.livy:livy-server. It affects 1 product.","exploited":"There is no known exploitation of CVE-2025-60012 in the wild and no public exploit code.","fix":"Upgrade org.apache.livy:livy-server to 0.9.0-incubating or later.","what":"CVE-2025-60012 is a medium-severity path traversal vulnerability in Apache Livy, published on 13 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-60012 and fix it if it is affected.\n\nWhat it is: CVE-2025-60012 is a medium-severity path traversal vulnerability in Apache Livy, published on 13 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-60012 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- org.apache.livy:livy-server (Maven): affected from 0.7.0-incubating; fixed in 0.9.0-incubating\n- org.apache.livy:livy-server (Maven): affected from 0.7.0-incubating; fixed in 0.9.0-incubating\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-60012/ (Markdown: https://insights.sbomify.com/CVE-2025-60012/index.md)","id":"CVE-2025-60012","markdown":"https://insights.sbomify.com/CVE-2025-60012/index.md","name":"CVE-2025-60012","record":{"aliases":["GHSA-hm8x-rpgg-7855"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Apache Livy","requires_auth":"low_privilege","summary":"Attackers with REST or JDBC access can manipulate Spark configurations to read unauthorized files in Apache Livy.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[{"product":"livy","vendor":"apache"}],"cvss":{"score":6.3,"severity":"medium","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"description":"Malicious configuration can lead to unauthorized file access in Apache Livy.\n\nThis issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later.\n\nA request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to files they do not have permissions to.\n\nFor the vulnerability to be exploitable, the user needs to have access to Apache Livy's REST or JDBC interface and be able to send requests with arbitrary Spark configuration values.\n\nUsers are recommended to upgrade to version 0.9.0 or later, which fixes the issue.","ecosystems":["Maven"],"exploits":{"exploitdb":0,"first_seen":"2026-03-15","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-03-15T15:17:40Z","kind":"github_poc","ref":"https://github.com/sid6224/CVE-2025-60012-POC","stars":0,"title":"A POC for the Apache Livy Unauthorized File Access Vunerability"}],"tier":"poc_unverified"},"has_fix":true,"headline":"Apache Livy: Restrict file access","id":"CVE-2025-60012","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":null,"products":[],"type":"path_traversal","year":"2025"},"n_packages":2,"n_references":1,"next":{"headline":"F5OS-A FIPS HSM password vulnerability","id":"CVE-2025-60013"},"packages":[{"ecosystem":"Maven","fixed":["0.9.0-incubating"],"introduced":["0.7.0-incubating"],"last_affected":[],"package":"org.apache.livy:livy-server","purl":null,"source":"GHSA-hm8x-rpgg-7855"},{"ecosystem":"Maven","fixed":["0.9.0-incubating"],"introduced":["0.7.0-incubating"],"last_affected":[],"package":"org.apache.livy:livy-server","purl":"pkg:maven/org.apache.livy/livy-server","source":"GHSA-hm8x-rpgg-7855"}],"prev":{"headline":"Denial of service in Junos OS","id":"CVE-2025-60011"},"products":["Apache Livy"],"published":"2026-03-13","related":[{"cvss_score":6.3,"headline":"Apache Livy: Unauthorized directory access","id":"CVE-2025-66249","kev_date_added":null,"published":"2026-03-13"},{"cvss_score":5.4,"headline":"Apache Livy (Incubating) is vulnerable to cross site scripting","id":"CVE-2021-26544","kev_date_added":null,"published":"2021-02-20"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-03-13","vendors":["Apache Software Foundation"]},"summary":"Attackers with REST or JDBC access can manipulate Spark configurations to read unauthorized files in Apache Livy.","url":"https://insights.sbomify.com/CVE-2025-60012/"}