Is CVE-2025-60012 actively exploited?

No active exploitation of CVE-2025-60012 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-60012 be exploited remotely?

Yes. CVE-2025-60012 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-60012?

CVE-2025-60012 has a CVSS score of 6.3 (MEDIUM).

HOME VULNERABILITIESCVE-2025-60012

MEDIUM

CVE-2025-60012

CWE-20Published: March 13, 2026· Updated: Mar 19, 2026

6.3

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:13.4th

Official Description

Malicious configuration can lead to unauthorized file access in Apache Livy.

This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later.

A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to files they do not have permissions to.

For the vulnerability to be exploitable, the user needs to have access to Apache Livy's REST or JDBC interface and be able to send requests with arbitrary Spark configuration values.

Users are recommended to upgrade to version 0.9.0 or later, which fixes the issue.

NVD Source

Technical Analysis

CVE-2025-60012 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.