CVE-2026-33227: Apache ActiveMQ Path Traversal Vulnerability
Summary
CVE-2026-33227: Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. Affects activemq across 2 version ranges.
< 5.19.3
>= 6.0.0, < 6.2.2
Fixed in 5.19.3 or 6.2.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2026-33227 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source messaging server that facilitates communication between different applications through message queues. It supports various messaging protocols and is widely used for its reliability and scalability. However, it has a vulnerability related to improper validation of classpath path names, which can lead to security risks if exploited.
Vulnerability Detail
The vulnerability arises from improper validation and restriction of classpath path names in Apache ActiveMQ Client, Broker, All, Web, and other components. Specifically, when creating a Stomp consumer or browsing messages in the Web console, an authenticated user can manipulate the 'key' value to traverse the classpath due to path concatenation. This flaw exposes the application to potential classpath resource loading attacks, which could be exploited in conjunction with other vulnerabilities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.19.35.19.3 -
>= 6.0.0, < 6.2.26.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users should ensure that their ActiveMQ instances are not exposed to untrusted users, limiting access to authenticated users only. Additionally, monitoring logs for unusual access patterns can help mitigate potential exploitation.
Conclusion
The CVE-2026-33227 vulnerability in Apache ActiveMQ poses significant risks due to improper classpath path name validation. Users are strongly advised to upgrade to the latest patched versions to mitigate these risks. Implementing temporary workarounds can help reduce exposure until an upgrade is feasible.
See every vulnerability recorded for activemq →
FAQ
CVE-2026-33227 is a vulnerability in Apache ActiveMQ that allows authenticated users to exploit improper validation of classpath path names, potentially leading to security breaches.
The affected versions include Apache ActiveMQ Client, Broker, All, and Web before 5.19.3 and from 6.0.0 before 6.2.2.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow attackers to load unauthorized resources, potentially leading to further attacks on the system.
If immediate upgrading is not possible, ensure that access to the ActiveMQ instance is restricted to trusted users and monitor for any unusual activity.
Related vulnerabilities
Recent vulnerabilities recorded for activemq.
