Vulnerability record · CVE-2015-1830 · published 19 August 2015
CVE-2015-1830: Apache ActiveMQ fileserver path traversal allows JSP upload
Apache · Activemq
Apache ActiveMQ 5.x before 5.11.2 on Windows has a directory traversal flaw in the fileserver upload/download functionality for blob messages. An unauthenticated remote attacker can write JSP files into arbitrary directories, which can lead to remote code execution if the written file is served or executed.
Description
Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.
AV:N/AC:L/Au:N/C:N/I:P/A:N
Automated analysis
high priorityUnauthenticated network-reachable path traversal that can lead to code execution, with very high EPSS despite no KEV listing.
What it is
Apache ActiveMQ 5.x before 5.11.2 on Windows has a directory traversal flaw in the fileserver upload/download functionality for blob messages. An unauthenticated remote attacker can write JSP files into arbitrary directories, which can lead to remote code execution if the written file is served or executed.
Impact
An attacker can place attacker-controlled JSP files anywhere the ActiveMQ process can write, enabling code execution or web shell deployment depending on what serves those directories.
Attack surface
Reached over the network through the ActiveMQ fileserver blob message upload/download path; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required. The flaw is specific to Windows deployments.
Exploitation
Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high (0.844, 99.7th percentile) and public references include a Packet Storm shell-upload writeup, indicating known exploitation techniques exist.
What to do
- Upgrade Apache ActiveMQ to 5.11.2 or later, or apply the vendor advisory fix.
- Disable or restrict the fileserver upload/download functionality if it is not required.
- Restrict network access to ActiveMQ broker and web ports to trusted hosts only.
- Run the ActiveMQ service with least privilege and ensure its writable directories cannot serve executable content.
- Monitor and remove unexpected JSP files in ActiveMQ-accessible directories.
Detection
- Alert on JSP or other executable files appearing in ActiveMQ data, web, or temp directories.
- Monitor ActiveMQ logs for anomalous blob upload/download requests and traversal sequences such as ../.
- Watch for outbound or inbound connections to ActiveMQ ports from untrusted sources.
- Baseline and integrity-check files under ActiveMQ installation and data paths for unexpected additions.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2015-1830 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-1830), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
