CVE-2026-33227

Overview

Apache ActiveMQ Classic is an open-source, multi-protocol, Java-based message broker maintained by the Apache Software Foundation. It supports OpenWire, STOMP, AMQP and MQTT clients, fully supports JMS 1.1, and ships a web console for managing queues and topics. Its client, broker and web modules are published as Maven artifacts under org.apache.activemq.

A path traversal vulnerability (CVE-2026-33227) has been identified in the ActiveMQ FactoryFinder class, which allows authenticated attackers to make the broker load resources from outside the intended classpath directory. Two inputs reach it: the STOMP transformation header when creating a consumer, and the view parameter when browsing messages in the web console. The resulting classpath resource loading could potentially be chained with another attack to lead to an exploit.

Per OWASP: A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the web root folder.

This issue affects multiple versions of ActiveMQ.

Details

Module Info

• Product: ActiveMQ
• Affected packages: org.apache.activemq:activemq-client, org.apache.activemq:activemq-broker, org.apache.activemq:activemq-all, org.apache.activemq:activemq-web
• Affected versions: <5.19.3, >=6.0.0 <6.2.2
• GitHub repository: https://github.com/apache/activemq
• Published packages:
  • https://central.sonatype.com/artifact/org.apache.activemq/activemq-client
  • https://central.sonatype.com/artifact/org.apache.activemq/activemq-broker
  • https://central.sonatype.com/artifact/org.apache.activemq/activemq-all
  • https://central.sonatype.com/artifact/org.apache.activemq/activemq-web
• Package manager: Maven
• Fixed in:
  • OSS ActiveMQ 5.19.4, 6.2.3
  • NES for ActiveMQ v5.16.10

Vulnerability Info

This Medium-severity vulnerability is found in the org.apache.activemq:activemq-client package in multiple versions of ActiveMQ, and is reachable through the STOMP transport and the web console. FactoryFinder locates pluggable implementations by appending a key to a fixed resource directory and loading the properties file found there, then instantiating the class named by its class property. The key is concatenated onto the base path without any normalization or validation:

public Object newInstance(String key) throws IllegalAccessException, InstantiationException, IOException, ClassNotFoundException {
    return objectFactory.create(path+key);
}

The STOMP ProtocolConverter uses a finder rooted at META-INF/services/org/apache/activemq/transport/frametranslator/ and passes the client-supplied transformation header of a SUBSCRIBE or UNSUBSCRIBE frame straight to it:

FrameTranslator translator = findTranslator(command.getHeaders().get(Stomp.Headers.TRANSFORMATION));
...
translator = (FrameTranslator) FRAME_TRANSLATOR_FINDER.newInstance(header);

The web console's QueueBrowseServlet does the same with the view request parameter against META-INF/services/org/apache/activemq/web/view/:

String style = request.getParameter("view");
...
return (MessageRenderer) factoryFinder.newInstance(style);

Because the key may contain ../ sequences, an authenticated user can make the broker resolve a resource anywhere on the classpath, read it as a properties file, and instantiate whatever class its class property names. The loaded class is not checked against the expected interface or any allow-list before it is created. Upstream notes that the first fixed releases, 5.19.3 and 6.2.2, close this only on non-Windows systems because of a path separator resolution bug; 5.19.4 and 6.2.3 complete the fix.

Mitigation

Only recent versions of ActiveMQ are community-supported. Older lines are End-of-Life and will not receive public updates to address this issue. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported ActiveMQ release line (5.19.x or 6.3.x) that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Dawei Wang (finder)