An authenticated user can supply a specially crafted key value when creating a STOMP consumer or browsing messages via the Web console. The application concatenates this value to a classpath path without proper validation or restriction, enabling attackers to traverse the classpath boundary. This flaw allows arbitrary classpath resources to be loaded, potentially exposing sensitive files or enabling further attacks when chained with other vulnerabilities. The weakness is identified as a Path Traversal (CWE‑22).

All major ActiveMQ components—Client, Broker, All, Web, and the core product—are affected in versions prior to 5.19.3 and from 6.0.0 to, but not including, 6.2.2. Users running 5.x should move to 5.19.4 or any 5.19.3 or later on non‑Windows systems. Users on the 6.x line should upgrade to 6.2.3 or any 6.2.2 on non‑Windows, as those releases patch path‑separator handling and classpath traversal checks.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score is below 1%, with the vulnerability not listed in the CISA KEV catalog, suggesting limited likelihood of exploitation in the wild. However, because the flaw requires authentication and can expose sensitive resources, it may serve as a stepping stone for additional attacks, particularly if the application runs with elevated privileges. Exploitability depends on the environment and the privileges of the running process.