CVE-2026-33227
Description
Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.
How to fix
- apache activemq5.19.3, 6.2.2 or later
- apache activemq_broker5.19.3, 6.2.2 or later
- apache activemq_web5.19.3, 6.2.2 or later
- org.apache.activemq:activemq-client5.19.3, 6.2.2 or later
- org.apache.activemq:activemq-broker5.19.3, 6.2.2 or later
- org.apache.activemq:activemq-all5.19.3, 6.2.2 or later
- org.apache.activemq:activemq-web5.19.3, 6.2.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache activemq | v < 5.19.3, 6.0.0 ≤ v < 6.2.2 | 5.19.3, 6.2.2 |
| apache activemq_broker | v < 5.19.3, 6.0.0 ≤ v < 6.2.2 | 5.19.3, 6.2.2 |
| apache activemq_web | v < 5.19.3, 6.0.0 ≤ v < 6.2.2 | 5.19.3, 6.2.2 |
| org.apache.activemq:activemq-clientMaven | v < 5.19.3, 6.0.0 ≤ v < 6.2.2 | 5.19.3, 6.2.2 |
| org.apache.activemq:activemq-brokerMaven | v < 5.19.3, 6.0.0 ≤ v < 6.2.2 | 5.19.3, 6.2.2 |
| org.apache.activemq:activemq-allMaven | v < 5.19.3, 6.0.0 ≤ v < 6.2.2 | 5.19.3, 6.2.2 |
| org.apache.activemq:activemq-webMaven | v < 5.19.3, 6.0.0 ≤ v < 6.2.2 | 5.19.3, 6.2.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.