Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.

The version of Apache ActiveMQ running on the remote host is prior to 5.19.3 / 5.19.4 or 6.x prior to 6.2.2 / 6.2.3.
It is, therefore, affected by an improper validation and restriction of classpath path name vulnerability:

  - An authenticated user could exploit path concatenation to traverse the classpath in two specific contexts: when     creating a Stomp consumer and when browsing messages via the Web console. This vulnerability enables classpath path     resource loading that could potentially be combined with other attacks for exploitation. (CVE-2026-33227)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client,
    Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances (when
    creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided
    "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the
    application is exposed to a classpath path resource loading vulnerability that could potentially be
    chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before
    5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache
    ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0
    before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2. Users are recommended to upgrade to
    version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is
    limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.
    (CVE-2026-33227)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client,     Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances (when     creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided     key value could be constructed to traverse the classpath due to path concatenation. As a result, the     application is exposed to a classpath path resource loading vulnerability that could potentially be     chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before     5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache     ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0     before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2. Users are recommended to upgrade to     version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is     limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.
    (CVE-2026-33227)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
305954	Apache ActiveMQ < 5.19.3 / 5.19.4, 6.x < 6.2.2 / 6.2.3 Classpath Path Traversal	Nessus	CGI abuses	medium
440079	SCA: security update for org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker, org.apache.activemq:activemq-client, org.apache.activemq:activemq-web (GHSA-h2h4-5m64-m273)	Tenable Cloud Security	SCA Checks	medium
440079	SCA: security update for org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker, org.apache.activemq:activemq-client, org.apache.activemq:activemq-web (GHSA-h2h4-5m64-m273)	Tenable Self-Hosted Container Security	SCA Checks	medium
305218	Linux Distros Unpatched Vulnerability : CVE-2026-33227	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-33227

medium

Tenable Plugins

medium

medium

medium

medium