CVE-2026-33227

CWE-22Path Traversal9 documents7 sources
Severity
4.3MEDIUM
EPSS
0.1%
top 84.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedApr 7

Description

Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that cou

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages9 packages

🔴Vulnerability Details

4
OSV
Apache ActiveMQ: Improper validation and restriction of a classpath path name2026-04-07
OSV
CVE-2026-33227: Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All2026-04-07
GHSA
Apache ActiveMQ: Improper validation and restriction of a classpath path name2026-04-07
CVEList
Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory2026-04-07

📋Vendor Advisories

1
Red Hat
org.apache.activemq/activemq-client: org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: org.apache.activemq/activemq-web: improper limitation of a pathname to a restricted classpat2026-04-07

🕵️Threat Intelligence

1
Wiz
CVE-2026-33227 Impact, Exploitability, and Mitigation Steps | Wiz

💬Community

2
Bugzilla
CVE-2026-33227 log4j: improper limitation of a pathname to a restricted classpath directory [fedora-all]2026-04-07
Bugzilla
CVE-2026-33227 org.apache.activemq/activemq-client: org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: org.apache.activemq/activemq-web: improper limitation of a pathname to a rest2026-04-07