CVE-2021-26544

Affected software: Apache Livy server 0.7.0-incubating. Issue: cross-site scripting (XSS) in the session name. Impact: a malicious user could access logs and results of other users’ sessions and run jobs with those users’ privileges. Root cause: XSS in session-name handling. Remediation: the fixe...

CVE-2025-66249

Apache Livy versions 0.3.0 through 0.8.x are vulnerable to a Path Traversal vulnerability due to improper limitation of pathnames to a restricted directory. This flaw can be exploited only when the livy.file.local-dir-whitelist configuration value is set to a non-default value, allowing an attack...

CVE-2025-60012

Apache Livy versions 0.7.0 and 0.8.0 are vulnerable to unauthorized file access when connected to Apache Spark 3.1 or later. The root cause involves an input validation error where the spark.archives configuration key was missing from the hardcoded list of keys validated against the local filesys...