Apache Livy: Unauthorized directory access

中 6.3CVE-2025-66249 · GHSA-h84f-4ff9-8hc3 · 13/03/2026 公開 · 17/06/2026 更新

要点

CVE-2025-66249 は org.apache.livy:livy-server, livy (apache) に影響する深刻度「中」 (CVSS 6.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.61%（全脆弱性の 49.2% より高い）。
対処：0.9.0-incubating, 0.9.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.apache.livy:livy-server Maven	`≥ 0.3.0-incubating, < 0.9.0-incubating`	`0.9.0-incubating`
livy apache	`≥ 0.3.0, < 0.9.0`	`0.9.0`

概要

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Livy.

This issue affects Apache Livy: from 0.3.0 before 0.9.0.

The vulnerability can only be exploited with non-default Apache Livy Server settings. If the configuration value "livy.file.local-dir-whitelist" is set to a non-default value, the directory checking can be bypassed.

Users are recommended to upgrade to version 0.9.0, which fixes the issue.

NVD の説明

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Livy. This issue affects Apache Livy: from 0.3.0 before 0.9.0. The vulnerability can only be exploited with non-default Apache Livy Server settings. If the configuration value "livy.file.local-dir-whitelist" is set to a non-default value, the directory checking can be bypassed. Users are recommended to upgrade to version 0.9.0, which fixes the issue.