CVE-2026-33227

Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory

MEDIUM

4.3

CVSS Score

Published: April 7, 2026 at 07:50 AM UTC

Updated: October 26, 2026 at 10:10 PM UTC

4 products affected across 1 vendorActiveMQApache ActiveMQ BrokerApache ActiveMQ Web

Using Apache ActiveMQ Client by Apache Software Foundation?

Get instant alerts when new vulnerabilities affect Apache ActiveMQ Client - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM4.3

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All. In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit.This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

ActiveMQ · Apachemaven

95%

v < 5.19.36.0.0 ≤ v < 6.2.26.0.0

Affected range stops below 5.19.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.2.2, so it looks safe — our inference, not a vendor statement

Apache ActiveMQ Broker · Apachemaven

95%

v < 5.19.36.0.0 ≤ v < 6.2.26.0.0

Affected range stops below 5.19.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.2.2, so it looks safe — our inference, not a vendor statement

Apache ActiveMQ Web · Apachemaven

95%

v < 5.19.36.0.0 ≤ v < 6.2.26.0.0

Affected range stops below 5.19.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.2.2, so it looks safe — our inference, not a vendor statement

ActiveMQ All · Apachemaven

90%

v < 5.19.36.0.0 ≤ v < 6.2.26.0.0

Affected range stops below 5.19.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.2.2, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://activemq.apache.org/security-advisories.data/CVE-2026-33227-announcement.txt

References (2)

Vendor Advisory

Source: cverecord

https://activemq.apache.org/security-advisories.data/CVE-2026-33227-announcement.txt

Mailing ListThird Party Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2026/04/06/4

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

4.3MEDIUMCISA-ADP

Attack Vector: NETWORK
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: LOW
Integrity: NONE
Availability: NONE

Vector?

Quick Info

StatusANALYZED

CWE

CWE-22

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card