{"id":"CVE-2019-17572","aliases":["EUVD-2020-0539","GHSA-5x3v-2gxr-59m2"],"status":"published","title":"Directory traversal in Apache RocketMQ","description":"In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. Users of the affected versions should apply one of the following: Upgrade to Apache RocketMQ 4.6.1 or later.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02985,"percentile":0.87477,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2020-05-14T16:10:48Z","modified":"2026-10-24T10:30:58Z","exploits":[{"source":"pocgithub","id":"shoucheng3/apache__rocketmq_CVE-2019-17572_4-6-0","title":"shoucheng3/apache__rocketmq_CVE-2019-17572_4-6-0","date":"2025-08-16","url":"https://github.com/shoucheng3/apache__rocketmq_CVE-2019-17572_4-6-0"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.rocketmq:rocketmq-broker","fixed_in":["4.6.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.rocketmq:rocketmq-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.6.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.rocketmq:rocketmq-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.6.1"}]}],"versions":["4.2.0","4.3.0","4.3.1","4.3.2","4.4.0","4.5.0","4.5.1","4.5.2","4.6.0"]}],"products":[{"vendor":"apache","product":"rocketmq"},{"vendor":"apache software foundation","product":"apache rocketmq"}],"references":[{"url":"https://lists.apache.org/thread.html/fdea1c5407da47a17d5522fa149a097cacded1916c1c1534d46edc6d%40%3Cprivate.rocketmq.apache.org%3E","tags":["x_refsource_MISC","x_transferred","Broken Link","web"]},{"url":"https://seclists.org/oss-sec/2020/q2/112","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17572","tags":["advisory"]},{"url":"https://github.com/apache/rocketmq/issues/1637","tags":["web"]},{"url":"https://github.com/apache/rocketmq/commit/f8f6fbe4aa7f5dee937e688322628c366b12a552","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEROCKETMQ-569108","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5x3v-2gxr-59m2"}],"sources":{"cve":[{"id":"CVE-2019-17572","description":"In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. Users of the affected versions should apply one of the following: Upgrade to Apache RocketMQ 4.6.1 or later.","status":"published","published":"2020-05-14T16:10:48Z","modified":"2024-08-05T01:40:15.813Z","updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2020-0539","description":"In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. Users of the affected versions should apply one of the following: Upgrade to Apache RocketMQ 4.6.1 or later.","status":"published","published":"2020-05-14T16:10:48Z","modified":"2024-08-05T01:40:15Z","updated_at":"2026-11-03T02:40:29.306082Z"}],"ghsa":[{"id":"GHSA-5x3v-2gxr-59m2","title":"Directory traversal in Apache RocketMQ","description":"In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. Users of the affected versions should apply one of the following: Upgrade to Apache RocketMQ 4.6.1 or later.","status":"published","published":"2020-07-01T17:26:15Z","modified":"2023-01-09T05:03:26Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:05.071174Z"}],"nvd":[{"id":"CVE-2019-17572","description":"In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. Users of the affected versions should apply one of the following: Upgrade to Apache RocketMQ 4.6.1 or later.","status":"published","published":"2020-05-14T17:15:11.977Z","modified":"2026-06-17T02:24:12.187Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:46.451008Z"}],"osv":[{"id":"CVE-2019-17572","description":"In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. Users of the affected versions should apply one of the following: Upgrade to Apache RocketMQ 4.6.1 or later.","status":"published","published":"2020-05-14T17:15:11.977Z","modified":"2026-10-24T10:30:58.575329362Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"GHSA-5x3v-2gxr-59m2","title":"Directory traversal in Apache RocketMQ","description":"In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. Users of the affected versions should apply one of the following: Upgrade to Apache RocketMQ 4.6.1 or later.","status":"published","published":"2020-07-01T17:26:15Z","modified":"2024-12-02T05:32:40.753141Z","cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:38.911014Z"}]}}