Classpath Path Name Vulnerability in Apache ActiveMQ Products

CVE-2026-33227

What is CVE-2026-33227?

An improper validation and restriction issue has been identified in Apache ActiveMQ, which can allow authenticated users to construct a 'key' value that can lead to unintended classpath traversal. This vulnerability primarily manifests during the creation of Stomp consumers and when browsing messages in the Web console. If exploited, it enables the loading of unintended resources due to path concatenation. Users are strongly advised to upgrade their installations to version 5.19.4 or 6.2.3, which address the issue effectively. While versions 5.19.3 and 6.2.2 also resolve this vulnerability, their fixes are applicable only in non-Windows environments due to specific path handling bugs.

References