PT-2026-25061 · Apache · Apache Ivy+1

Furue Hideyuki · Published 2026-03-12 · Updated 2026-03-14 · CVE-2025-60012

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Apache Livy versions 0.7.0 and 0.8.0

Description A malicious configuration can lead to unauthorized file access in Apache Livy. This issue occurs when connecting to Apache Spark 3.1 or later. A request including a Spark configuration value supported from Apache Spark version 3.1 can allow users to gain access to files they are not permitted to access. Exploitation requires access to the Apache Livy REST or JDBC interface and the ability to send requests with arbitrary Spark configuration values. The vulnerable component is the Spark configuration processing logic within Apache Livy.

Recommendations Upgrade to version 0.9.0 or later to resolve this issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-60012

GHSA-HM8X-RPGG-7855

Affected Products

Apache Ivy

Apache Spark

References · 10

• https://osv.dev/vulnerability/GHSA-hm8x-rpgg-7855 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-60012 · Vendor Advisory
• https://lists.apache.org/thread/gpc85fwrgrbglpk9gm8tmcjzqnctx64w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-60012 · Security Note
• https://github.com/apache/incubator-livy · Note
• https://twitter.com/oss_security/status/2032147522211213428 · Twitter Post
• https://twitter.com/CVEnew/status/2032831379713720574 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2032271616814518726 · Twitter Post
• http://openwall.com/lists/oss-security/2026/03/12/1 · Note
• https://twitter.com/cyberbivash/status/2032541056084963343 · Twitter Post