This vulnerability (CVE-2026-33227) in Apache ActiveMQ Client and related components arises from improper validation and restriction of classpath path names (CWE-22). Specifically, when an authenticated user provides a crafted "key" value during Stomp consumer creation or message browsing in the Web console, path concatenation allows traversal of the classpath resource loading mechanism. This can potentially be chained with other attacks. Affected versions include Apache ActiveMQ Client, Broker, All, Web, and core Apache ActiveMQ before 5.19.3 and from 6.0.0 before 6.2.2. Partial fixes in 5.19.3 and 6.2.2 do not fully address the issue on Windows due to path separator handling bugs. Complete fixes are included in versions 5.19.4 and 6.2.3.

The vulnerability allows an authenticated user to perform classpath traversal via crafted input, potentially exposing internal resources or enabling further chained attacks. The CVSS score is 4.3 (medium severity), reflecting low confidentiality impact and no integrity or availability impact. There are no known exploits in the wild at this time.

Users should upgrade Apache ActiveMQ components to version 5.19.4 or 6.2.3, which fully fix the vulnerability including Windows path separator issues. Versions 5.19.3 and 6.2.2 provide partial fixes limited to non-Windows environments. Patch status is confirmed by the vendor advisory embedded in the description. No other mitigations are indicated.