This vulnerability arises from unsafe parsing of OpenMQ’s configuration, permitting an attacker to read arbitrary files on the broker’s host operating system. The flaw enables path traversal, allowing access to files outside the intended configuration directory. A full exploitation could leak sensitive data, and in certain scenarios remote code execution may be achieved.

The affected product is Eclipse OpenMQ from Eclipse Foundation. Specific version information is not provided in the CVE data, so any deployment using OpenMQ should review its current version against the vendor’s advisories.

With a CVSS score of 9.1, the vulnerability is considered severe. The EPSS score of less than 1% indicates a low estimated probability of exploitation at this time, and it is not listed in the CISA KEV catalog. The likely attack vector is remote, via the OpenMQ configuration interface, and any attacker who can send crafted configuration data can read arbitrary files or potentially execute code depending on the environment.