SB20260824136 - Multiple vulnerabilities in Apache Wicket

Description

This security bulletin contains information about 2 vulnerabilities.

1) Cross-site scripting (CVE-ID: CVE-2026-66390)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary script code in a user's browser.

The vulnerability exists due to improper neutralization of input during web page generation in Link URL handling when rendering crafted Link URL strings into a JavaScript sequence. A remote attacker can supply a specially crafted Link URL string to execute arbitrary script code in a user's browser.

2) Protection mechanism failure (CVE-ID: CVE-2026-66391)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass content security policy protections.

The vulnerability exists due to protection mechanism failure and use of insufficiently random values in csp header handling when processing web requests. A remote attacker can trigger responses with leaked or missing csp headers to bypass content security policy protections.

Remediation

Install update from vendor's website.

References

• https://lists.apache.org/api/email.lua?id=o0tv8kygzo06o2pj90ppz43hhgson194
• https://wicket.apache.org/
• https://lists.apache.org/api/email.lua?id=7py2fc86jw90220ph2tmf4gtxtl6ton2