CVE-2026-52760
EUVD-2026-4027930.06.2026, 11:16
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console.
The browse page in the web console renders a message Id directly without sanitization. This allows an authenticated producer to send a message with a JMS message ID that has been crafted to contain HTML/JavaScript such that when an administrator browses the queue in the Web Console, the payload executes in their browser.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Web Console: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| apache | activemq | 𝑥 < 5.19.8 |
| apache | activemq | 6.0.0 ≤ 𝑥 < 6.2.7 |
| apache | activemq_web | 𝑥 < 5.19.8 |
| apache | activemq_web | 6.0.0 ≤ 𝑥 < 6.2.7 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases