CVE-2025-66249: Apache Livy Unauthorized Directory Access Vulnerability
Summary
CVE-2025-66249: Apache Livy: Unauthorized directory access. Affects org.apache.livy:livy-server versions >= 0.3.0-incubating, < 0.9.0-incubating. Fixed in 0.9.0-incubating. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Livy is an open-source project that provides a REST interface for interacting with Apache Spark. It allows users to submit Spark jobs and manage their execution. Livy is designed to simplify the process of using Spark in a multi-user environment. However, certain configurations can expose it to vulnerabilities, such as unauthorized access to directories.
Vulnerability Detail
The vulnerability identified as CVE-2025-66249 is a Path Traversal issue in Apache Livy, affecting versions from 0.3.0 before 0.9.0. This flaw arises from improper limitations on pathname restrictions, allowing attackers to bypass directory checks if the configuration value 'livy.file.local-dir-whitelist' is set to a non-default value. Exploiting this vulnerability could lead to unauthorized access to sensitive files on the server, potentially compromising data integrity and confidentiality.
How To Fix
Minimum fixed version
0.9.0-incubating
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, a temporary workaround is to ensure that the 'livy.file.local-dir-whitelist' configuration is set to a default value, which restricts access to only the intended directories. This can be done by modifying the Livy configuration file to include:
livy.file.local-dir-whitelist=/path/to/allowed/directory
Conclusion
The CVE-2025-66249 vulnerability in Apache Livy poses a risk of unauthorized directory access due to improper pathname limitations. Users are strongly advised to upgrade to version 0.9.0 or later to mitigate this risk. For those unable to upgrade immediately, adjusting configuration settings can serve as a temporary workaround.
See every vulnerability recorded for org.apache.livy:livy-server →
FAQ
The vulnerability has a CVSS score of 6.3, indicating a moderate severity level.
The vulnerability affects Apache Livy versions from 0.3.0 to before 0.9.0.
Exploitation could lead to unauthorized access to sensitive directories and files on the server, potentially compromising data security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, ensure that the 'livy.file.local-dir-whitelist' is set to a default value to mitigate the risk temporarily.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.livy:livy-server.
