CVE-2025-60012

CVE-2025-60012 is a medium-severity vulnerability affecting Apache Livy versions 0.7.0 and 0.8.0 when connected to Apache Spark 3.1 or later. This flaw allows authenticated users with access to Livy's REST or JDBC interface to gain unauthorized access to files by submitting malicious Spark configuration values. Rated CVSS 6.3 (Medium), the vulnerability has a network attack vector and low attack complexity, requiring low privileges to achieve low impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, nor are there public exploit codes available, and it is not listed in CISA's Known Exploited Vulnerabilities catalog.