Loading vulnerability…
Classpath Path Traversal in Apache ActiveMQ
CVE-2026-33227 is an improper validation and restriction of a pathname vulnerability affecting multiple Apache ActiveMQ components, including ActiveMQ Client, Broker, All, Web, and ActiveMQ. In two code paths—when creating a STOMP consumer and when browsing messages in the web console—an authenticated user-controlled "key" value is concatenated into a path without sufficient validation, allowing traversal within the classpath. This can cause unintended classpath resource loading. Apache notes that the issue may be chainable with another attack to achieve further exploitation. Affected versions are ActiveMQ 5.x before 5.19.3 and 6.x from 6.0.0 before 6.2.2, with later clarification that the complete fix for Windows requires newer releases.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated attacker to influence classpath resource resolution and load unintended classpath resources through crafted path traversal input. On its own, the issue is described as exposing the application to a classpath resource loading condition rather than direct standalone remote code execution, but Apache explicitly states it could potentially be chained with another attack to reach more serious outcomes. The vulnerable surfaces are STOMP consumer creation and message browsing in the ActiveMQ web console.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, reduce exposure by restricting access to authenticated interfaces involved in exploitation, specifically STOMP consumer creation functionality and the ActiveMQ web console. Limit or disable unnecessary web console access, tightly control authenticated user access, and avoid exposing these management or messaging interfaces to untrusted users or networks. However, no complete mitigation is provided in the source content; upgrading remains the definitive fix.
Patch, then assume compromise.
Upgrade Apache ActiveMQ to 5.19.4 or 6.2.3. Although versions 5.19.3 and 6.2.2 addressed the issue for non-Windows environments, Apache states those releases were incomplete on Windows because of a path separator resolution bug. The recommended fixed versions are therefore 5.19.4 and 6.2.3.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.