Apache Livy is vulnerable to a Path Traversal flaw (CWE‑22) that allows an attacker to read or access files outside the intended directory by bypassing pathname checks. This can lead to unauthorized disclosure of server files and potential compromise of configuration data if the server is exposed to an attacker.

The vulnerability affects all Apache Livy installations from version 0.3.0 up to, but not including, version 0.9.0. The product is released by the Apache Software Foundation and is identified by the CPE cpe:2.3:a:apache:livy:*:*:*:*:*:*:*:*.

The CVSS score of 6.3 indicates moderate risk, while the EPSS score of less than 1 % suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the server to be configured with a non‑default value for the livy.file.local-dir-whitelist setting; without this misconfiguration, the directory traversal cannot be performed.