Description
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | activemq | 5.14.0+dfsg-1 | — |
| Debian 12 | activemq | 5.14.0+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | activemq | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
ActiveMQ web shell upload
exploit/multi/http/apache_activemq_upload_jsp
Exploit-DB 2
- ActiveMQ < 5.14.0 - Web Shell Upload (Metasploit) EDB-42283 · remote · Jun 29, 2017 · verified
- Apache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution EDB-40857 · remote · Aug 17, 2015 · verified
GitHub 9 repositories
-
Catherines77/ActiveMQ-EXPtools ★ 86 · Apr 20, 2026
Apache ActiveMQ漏洞综合利用工具(CVE-2015-5254，CVE-2016-3088，CVE-2022-41678，CVE-2023-46604，CVE-2024-32114，CVE-2026-34197，CVE-2026-40466， CVE-2026-42588)
-
YutuSec/ActiveMQ_Crack ★ 18 · Apr 2, 2022
ActiveMQ系列漏洞探测利用工具，包括ActiveMQ 默认口令漏洞及ActiveMQ任意文件写入漏洞（CVE-2016-3088），支持批量探测利用。
-
Ma1Dong/ActiveMQ_putshell-CVE-2016-3088 ★ 15 · Jul 31, 2020
ActiveMQ_putshell直接获取webshell
-
cyberaguiar/CVE-2016-3088 ★ 5 · Mar 11, 2021
Apache ActiveMQ Remote Code Execution Exploit
-
cl4ym0re/CVE-2016-3088 ★ 4 · Jul 3, 2021
Apache ActiveMQ PUT RCE Scan
-
CyberCTF/vulhub-activemq-cve-2016-3088 ★ 0 · Oct 8, 2026
Vulhub activemq/CVE-2016-3088: ActiveMQ Fileserver Arbitrary File Write (CVE-2016-3088), run with Isoloom
-
HeArtE4t3r/CVE-2016-3088 ★ 0 · Jun 16, 2025
A Python-based Exploit Script for CVE-2016-3088
-
vonderchild/CVE-2016-3088 ★ 0 · Mar 12, 2021
-
wood03mm/CVE-2016-3088 ★ 0 · Dec 24, 2020
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache ActiveMQ Fileserver - Arbitrary File Write http/cves/2016/CVE-2016-3088.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.activemq:activemq-client | >= 5.0.0, < 5.14.0 | 5.14.0 | GHSA-rxqh-fc23-gxp2 |
References
- http://www.zerodayinitiative.com/advisories/ZDI-16-356
- 42283 exploit
- http://www.zerodayinitiative.com/advisories/ZDI-16-357
- http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt
- RHSA-2016:2036 vendor-advisory
- 1035951 vdb-entry
- [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/ mailing-list
- [activemq-users] 20190703 Re: ActiveMQ cve vulnerabilities seen in latest version mailing-list
- [announce] 20200131 Apache Software Foundation Security Report: 2019 mailing-list