[<prev] [next>] [day] [month] [year] [list]
Message-ID: <bf0d6b16-01de-4249-1f8c-0daccf102f14@apache.org>
Date: Mon, 06 Apr 2026 13:07:18 +0000
From: "Christopher L. Shannon" <cshannon@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-33227: Apache ActiveMQ Client, Apache ActiveMQ Broker,
Apache ActiveMQ, Apache ActiveMQ Web: Improper Limitation of a Pathname to
a Restricted Directory
Severity: low
Affected versions:
- Apache ActiveMQ Client (org.apache.activemq:activemq-client) before 5.19.3
- Apache ActiveMQ Client (org.apache.activemq:activemq-client) 6.0.0 before 6.2.2
- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) before 5.19.3
- Apache ActiveMQ Broker (org.apache.activemq:activemq-broker) 6.0.0 before 6.2.2
- Apache ActiveMQ (org.apache.activemq:activemq-all) before 5.19.3
- Apache ActiveMQ (org.apache.activemq:activemq-all) 6.0.0 before 6.2.2
- Apache ActiveMQ Web (org.apache.activemq:activemq-web) before 5.19.3
- Apache ActiveMQ Web (org.apache.activemq:activemq-web) 6.0.0 before 6.2.2
Description:
Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All.
In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit.This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2.
Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.
Credit:
Dawei Wang (finder)
References:
https://activemq.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-33227
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
