Vulnerability · Published Apr 7, 2026 · Assigned by apache
CVE-2026-33227Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory
Medium 4.3
In plain English
A medium-severity path traversal in Apache ActiveMQ from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | activemq | no fix listed | DEBIAN-CVE-2026-33227 |
| Debian:13 | activemq | no fix listed | DEBIAN-CVE-2026-33227 |
| Maven | org.apache.activemq:activemq-all | 5.19.3 | GHSA-h2h4-5m64-m273 |
| Maven | org.apache.activemq:activemq-all | 6.2.2 | GHSA-h2h4-5m64-m273 |
| Maven | org.apache.activemq:activemq-broker | 5.19.3 | GHSA-h2h4-5m64-m273 |
| Maven | org.apache.activemq:activemq-broker | 6.2.2 | GHSA-h2h4-5m64-m273 |
| Maven | org.apache.activemq:activemq-client | 5.19.3 | GHSA-h2h4-5m64-m273 |
| Maven | org.apache.activemq:activemq-client | 6.2.2 | GHSA-h2h4-5m64-m273 |
| Maven | org.apache.activemq:activemq-web | 6.2.2 | GHSA-h2h4-5m64-m273 |
| Maven | org.apache.activemq:activemq-web | 5.19.3 | GHSA-h2h4-5m64-m273 |
| Ubuntu:24.04:LTS | activemq | no fix listed | UBUNTU-CVE-2026-33227 |
| Ubuntu:25.10 | activemq | no fix listed | UBUNTU-CVE-2026-33227 |
| Ubuntu:26.04:LTS | activemq | no fix listed | UBUNTU-CVE-2026-33227 |
| Ubuntu:26.10 | activemq | no fix listed | UBUNTU-CVE-2026-33227 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache ActiveMQ Client | 0 – before 5.19.36.0.0 – before 6.2.2 |
| Apache Software Foundation | Apache ActiveMQ Broker | 0 – before 5.19.36.0.0 – before 6.2.2 |
| Apache Software Foundation | Apache ActiveMQ All | 0 – before 5.19.36.0.0 – before 6.2.2 |
| Apache Software Foundation | Apache ActiveMQ Web | 0 – before 5.19.36.0.0 – before 6.2.2 |
| Apache Software Foundation | Apache ActiveMQ | 0 – before 5.19.36.0.0 – before 6.2.2 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N