Search criteria

6 vulnerabilities found for livy by apache

CVE-2025-66249 (GCVE-0-2025-66249)

Vulnerability from nvd – Published: 2026-03-13 15:21 – Updated: 2026-03-13 18:11
VLAI?
Title
Apache Livy: Unauthorized directory access
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Livy. This issue affects Apache Livy: from 0.3.0 before 0.9.0. The vulnerability can only be exploited with non-default Apache Livy Server settings. If the configuration value "livy.file.local-dir-whitelist" is set to a non-default value, the directory checking can be bypassed. Users are recommended to upgrade to version 0.9.0, which fixes the issue.
Severity ?
No CVSS data available.
CWE
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Livy Affected: 0.3.0-incubating , < 0.9.0-incubating (semver)
Create a notification for this product.
Credits
Hiroki Egawa
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-03-13T16:13:45.211Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/12/2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-66249",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-13T18:11:38.674235Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-13T18:11:59.840Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.livy:livy-server",
          "product": "Apache Livy",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "0.9.0-incubating",
              "status": "affected",
              "version": "0.3.0-incubating",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Hiroki Egawa"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Apache Livy.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Livy: from 0.3.0 before 0.9.0.\u003c/p\u003e\u003cp\u003eThe vulnerability can only be exploited with non-default Apache Livy Server settings. If\u0026nbsp;the configuration value \"livy.file.local-dir-whitelist\" is set to a non-default value, the directory checking can be bypassed.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.9.0, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Apache Livy.\n\nThis issue affects Apache Livy: from 0.3.0 before 0.9.0.\n\nThe vulnerability can only be exploited with non-default Apache Livy Server settings. If\u00a0the configuration value \"livy.file.local-dir-whitelist\" is set to a non-default value, the directory checking can be bypassed.\n\nUsers are recommended to upgrade to version 0.9.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-13T15:21:53.722Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/1xwphsfn4jbtym4k4o0zlvwfogwqwwc3"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Livy: Unauthorized directory access",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-66249",
    "datePublished": "2026-03-13T15:21:53.722Z",
    "dateReserved": "2025-11-25T20:04:17.179Z",
    "dateUpdated": "2026-03-13T18:11:59.840Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-60012 (GCVE-0-2025-60012)

Vulnerability from nvd – Published: 2026-03-13 15:23 – Updated: 2026-03-13 18:11
VLAI?
Title
Apache Livy: Restrict file access
Summary
Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to files they do not have permissions to. For the vulnerability to be exploitable, the user needs to have access to Apache Livy's REST or JDBC interface and be able to send requests with arbitrary Spark configuration values. Users are recommended to upgrade to version 0.9.0 or later, which fixes the issue.
Severity ?
No CVSS data available.
CWE
  • CWE-20 - Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Livy Affected: 0.7.0-incubating , < 0.9.0-incubating (semver)
Create a notification for this product.
Credits
Furue Hideyuki
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-03-13T16:13:39.867Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/12/1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-60012",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-13T18:10:44.105010Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-13T18:11:24.588Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.livy:livy-server",
          "product": "Apache Livy",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "0.9.0-incubating",
              "status": "affected",
              "version": "0.7.0-incubating",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Furue Hideyuki"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMalicious configuration can lead to unauthorized file access in Apache Livy.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache\u0026nbsp;Spark 3.1 or later.\u003c/p\u003e\u003cp\u003eA request that includes a Spark configuration value supported from Apache\u0026nbsp;Spark version 3.1 can lead to users gaining access to files they do not have permissions to.\u003c/p\u003e\u003cp\u003eFor the vulnerability to be exploitable, the user needs to have access to Apache Livy\u0027s REST or JDBC interface and be able to send requests with arbitrary Spark configuration values.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.9.0 or later, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Malicious configuration can lead to unauthorized file access in Apache Livy.\n\nThis issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache\u00a0Spark 3.1 or later.\n\nA request that includes a Spark configuration value supported from Apache\u00a0Spark version 3.1 can lead to users gaining access to files they do not have permissions to.\n\nFor the vulnerability to be exploitable, the user needs to have access to Apache Livy\u0027s REST or JDBC interface and be able to send requests with arbitrary Spark configuration values.\n\nUsers are recommended to upgrade to version 0.9.0 or later, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-13T15:23:07.334Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/gpc85fwrgrbglpk9gm8tmcjzqnctx64w"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Livy: Restrict file access",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-60012",
    "datePublished": "2026-03-13T15:23:07.334Z",
    "dateReserved": "2025-09-23T19:07:43.584Z",
    "dateUpdated": "2026-03-13T18:11:24.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-26544 (GCVE-0-2021-26544)

Vulnerability from nvd – Published: 2021-02-20 09:00 – Updated: 2025-02-13 16:27
VLAI?
Title
Apache Livy (Incubating) is vulnerable to cross site scripting
Summary
Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.
Severity ?
No CVSS data available.
CWE
  • CWE-79 - Cross-site Scripting (XSS)
Assigner
Impacted products
Vendor Product Version
Apache Software Foundation Apache Livy (Incubating) Affected: Apache Livy (Incubating) 0.7.0-incubating
Create a notification for this product.
Credits
We would like to thank Andras Beni for reporting this issue
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:26:25.283Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E"
          },
          {
            "name": "[oss-security] 20210220 CVE-2021-26544: Apache Livy (Incubating) is vulnerable to cross site scripting",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/02/20/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Livy (Incubating)",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "Apache Livy (Incubating) 0.7.0-incubating"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "We would like to thank Andras Beni for reporting this issue"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users\u0027 sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-03T20:28:08.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E"
        },
        {
          "name": "[oss-security] 20210220 CVE-2021-26544: Apache Livy (Incubating) is vulnerable to cross site scripting",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/02/20/1"
        }
      ],
      "source": {
        "defect": [
          "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Apache Livy (Incubating) is vulnerable to cross site scripting",
      "workarounds": [
        {
          "lang": "en",
          "value": "Users can upgrade to 0.7.1-incubating or apply the patch at the github URL."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2021-26544",
          "STATE": "PUBLIC",
          "TITLE": "Apache Livy (Incubating) is vulnerable to cross site scripting"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Livy (Incubating)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_name": "Apache Livy (Incubating)",
                            "version_value": "0.7.0-incubating"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "We would like to thank Andras Beni for reporting this issue"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users\u0027 sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d",
              "refsource": "MISC",
              "url": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
            },
            {
              "name": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E"
            },
            {
              "name": "[oss-security] 20210220 CVE-2021-26544: Apache Livy (Incubating) is vulnerable to cross site scripting",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/02/20/1"
            }
          ]
        },
        "source": {
          "defect": [
            "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
          ],
          "discovery": "UNKNOWN"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "Users can upgrade to 0.7.1-incubating or apply the patch at the github URL."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2021-26544",
    "datePublished": "2021-02-20T09:00:15.000Z",
    "dateReserved": "2021-02-01T00:00:00.000Z",
    "dateUpdated": "2025-02-13T16:27:53.277Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-60012 (GCVE-0-2025-60012)

Vulnerability from cvelistv5 – Published: 2026-03-13 15:23 – Updated: 2026-03-13 18:11
VLAI?
Title
Apache Livy: Restrict file access
Summary
Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to files they do not have permissions to. For the vulnerability to be exploitable, the user needs to have access to Apache Livy's REST or JDBC interface and be able to send requests with arbitrary Spark configuration values. Users are recommended to upgrade to version 0.9.0 or later, which fixes the issue.
Severity ?
No CVSS data available.
CWE
  • CWE-20 - Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Livy Affected: 0.7.0-incubating , < 0.9.0-incubating (semver)
Create a notification for this product.
Credits
Furue Hideyuki
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-03-13T16:13:39.867Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/12/1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-60012",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-13T18:10:44.105010Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-13T18:11:24.588Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.livy:livy-server",
          "product": "Apache Livy",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "0.9.0-incubating",
              "status": "affected",
              "version": "0.7.0-incubating",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Furue Hideyuki"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMalicious configuration can lead to unauthorized file access in Apache Livy.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache\u0026nbsp;Spark 3.1 or later.\u003c/p\u003e\u003cp\u003eA request that includes a Spark configuration value supported from Apache\u0026nbsp;Spark version 3.1 can lead to users gaining access to files they do not have permissions to.\u003c/p\u003e\u003cp\u003eFor the vulnerability to be exploitable, the user needs to have access to Apache Livy\u0027s REST or JDBC interface and be able to send requests with arbitrary Spark configuration values.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.9.0 or later, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Malicious configuration can lead to unauthorized file access in Apache Livy.\n\nThis issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache\u00a0Spark 3.1 or later.\n\nA request that includes a Spark configuration value supported from Apache\u00a0Spark version 3.1 can lead to users gaining access to files they do not have permissions to.\n\nFor the vulnerability to be exploitable, the user needs to have access to Apache Livy\u0027s REST or JDBC interface and be able to send requests with arbitrary Spark configuration values.\n\nUsers are recommended to upgrade to version 0.9.0 or later, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-13T15:23:07.334Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/gpc85fwrgrbglpk9gm8tmcjzqnctx64w"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Livy: Restrict file access",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-60012",
    "datePublished": "2026-03-13T15:23:07.334Z",
    "dateReserved": "2025-09-23T19:07:43.584Z",
    "dateUpdated": "2026-03-13T18:11:24.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-66249 (GCVE-0-2025-66249)

Vulnerability from cvelistv5 – Published: 2026-03-13 15:21 – Updated: 2026-03-13 18:11
VLAI?
Title
Apache Livy: Unauthorized directory access
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Livy. This issue affects Apache Livy: from 0.3.0 before 0.9.0. The vulnerability can only be exploited with non-default Apache Livy Server settings. If the configuration value "livy.file.local-dir-whitelist" is set to a non-default value, the directory checking can be bypassed. Users are recommended to upgrade to version 0.9.0, which fixes the issue.
Severity ?
No CVSS data available.
CWE
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Livy Affected: 0.3.0-incubating , < 0.9.0-incubating (semver)
Create a notification for this product.
Credits
Hiroki Egawa
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-03-13T16:13:45.211Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/12/2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-66249",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-13T18:11:38.674235Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-13T18:11:59.840Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.livy:livy-server",
          "product": "Apache Livy",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "0.9.0-incubating",
              "status": "affected",
              "version": "0.3.0-incubating",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Hiroki Egawa"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Apache Livy.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Livy: from 0.3.0 before 0.9.0.\u003c/p\u003e\u003cp\u003eThe vulnerability can only be exploited with non-default Apache Livy Server settings. If\u0026nbsp;the configuration value \"livy.file.local-dir-whitelist\" is set to a non-default value, the directory checking can be bypassed.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.9.0, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Apache Livy.\n\nThis issue affects Apache Livy: from 0.3.0 before 0.9.0.\n\nThe vulnerability can only be exploited with non-default Apache Livy Server settings. If\u00a0the configuration value \"livy.file.local-dir-whitelist\" is set to a non-default value, the directory checking can be bypassed.\n\nUsers are recommended to upgrade to version 0.9.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-13T15:21:53.722Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/1xwphsfn4jbtym4k4o0zlvwfogwqwwc3"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Livy: Unauthorized directory access",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-66249",
    "datePublished": "2026-03-13T15:21:53.722Z",
    "dateReserved": "2025-11-25T20:04:17.179Z",
    "dateUpdated": "2026-03-13T18:11:59.840Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-26544 (GCVE-0-2021-26544)

Vulnerability from cvelistv5 – Published: 2021-02-20 09:00 – Updated: 2025-02-13 16:27
VLAI?
Title
Apache Livy (Incubating) is vulnerable to cross site scripting
Summary
Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.
Severity ?
No CVSS data available.
CWE
  • CWE-79 - Cross-site Scripting (XSS)
Assigner
Impacted products
Vendor Product Version
Apache Software Foundation Apache Livy (Incubating) Affected: Apache Livy (Incubating) 0.7.0-incubating
Create a notification for this product.
Credits
We would like to thank Andras Beni for reporting this issue
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:26:25.283Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E"
          },
          {
            "name": "[oss-security] 20210220 CVE-2021-26544: Apache Livy (Incubating) is vulnerable to cross site scripting",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/02/20/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Livy (Incubating)",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "Apache Livy (Incubating) 0.7.0-incubating"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "We would like to thank Andras Beni for reporting this issue"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users\u0027 sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-03T20:28:08.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E"
        },
        {
          "name": "[oss-security] 20210220 CVE-2021-26544: Apache Livy (Incubating) is vulnerable to cross site scripting",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/02/20/1"
        }
      ],
      "source": {
        "defect": [
          "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Apache Livy (Incubating) is vulnerable to cross site scripting",
      "workarounds": [
        {
          "lang": "en",
          "value": "Users can upgrade to 0.7.1-incubating or apply the patch at the github URL."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2021-26544",
          "STATE": "PUBLIC",
          "TITLE": "Apache Livy (Incubating) is vulnerable to cross site scripting"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Livy (Incubating)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_name": "Apache Livy (Incubating)",
                            "version_value": "0.7.0-incubating"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "We would like to thank Andras Beni for reporting this issue"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users\u0027 sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d",
              "refsource": "MISC",
              "url": "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
            },
            {
              "name": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/r2db14e7fd1e5ec2519e8828d43529bad623d75698cc7918af3a3f3ed%40%3Cuser.livy.apache.org%3E"
            },
            {
              "name": "[oss-security] 20210220 CVE-2021-26544: Apache Livy (Incubating) is vulnerable to cross site scripting",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/02/20/1"
            }
          ]
        },
        "source": {
          "defect": [
            "https://github.com/apache/incubator-livy/commit/4d8a912699683b973eee76d4e91447d769a0cb0d"
          ],
          "discovery": "UNKNOWN"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "Users can upgrade to 0.7.1-incubating or apply the patch at the github URL."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2021-26544",
    "datePublished": "2021-02-20T09:00:15.000Z",
    "dateReserved": "2021-02-01T00:00:00.000Z",
    "dateUpdated": "2025-02-13T16:27:53.277Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}