SB20260825100 - Multiple vulnerabilities in Apache Wicket

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260825100

SB20260825100 - Multiple vulnerabilities in Apache Wicket

Published: August 25, 2026

Security Bulletin ID SB20260825100
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 25% Medium 50% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Session Fixation (CVE-ID: CVE-2026-40010)

CWE-ID: CWE-384 - Session Fixation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to perform a session fixation attack.

The vulnerability exists due to improper session management in AuthenticatedWebSession when binding an authenticated session without changing the session ID. A remote user can reuse a fixed session identifier to perform a session fixation attack.


2) Cross-site scripting (CVE-ID: CVE-2026-42509)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script code in a victim's browser.

The vulnerability exists due to cross-site scripting in web page generation when processing crafted strings in JavaScript sequences. A remote attacker can supply a specially crafted string to execute arbitrary script code in a victim's browser.


3) Improper access control (CVE-ID: CVE-2026-43646)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in PackageResourceGuard when handling crafted URLs. A remote attacker can send a specially crafted request to disclose sensitive information.


4) Path traversal (CVE-ID: CVE-2026-43975)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to write arbitrary files outside the intended upload directory or read files from arbitrary locations on the server.

The vulnerability exists due to improper input validation in FolderUploadsFileManager when processing the uploadFieldId parameter or the clientFileName before constructing file paths. A remote attacker can send crafted input to write arbitrary files outside the intended upload directory or read files from arbitrary locations on the server.


Remediation

Install update from vendor's website.

References