SB2026083129 - Multiple vulnerabilities in Apache Wicket

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026083129

SB2026083129 - Multiple vulnerabilities in Apache Wicket

Published: August 31, 2026

Security Bulletin ID SB2026083129
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 vulnerabilities.


1) Path traversal (CVE-ID: CVE-2026-70449)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper input validation in package resource URL attribute handling when processing crafted resource requests. A remote attacker can supply crafted locale, style, or variation values containing path separators to disclose sensitive information.

On servlet containers that normalize .. in ServletContext.getResource(), the issue can expose files from the web application, including files under WEB-INF, and the pre-guard lookup acts as an existence oracle for arbitrary paths.


2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-71257)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass configured file upload limits and cause excessive memory consumption.

The vulnerability exists due to improper enforcement of upload restrictions in multipart upload handling when the multipart request has already been parsed by another component. A remote attacker can submit oversized or more numerous uploaded parts to bypass configured file upload limits and cause excessive memory consumption.

The issue affects upload handling paths that fall back to HttpServletRequest#getParts(), and a part without a Content-Type header is read fully into memory during parsing. Applications are affected only if per-file or file-count limits are configured.


3) Cross-site request forgery (CVE-ID: CVE-2026-71378)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass cross-site request forgery protections and perform actions in the victim's session.

The vulnerability exists due to improper access control in ResourceIsolationRequestCycleListener and its default FetchMetadataResourceIsolationPolicy when handling cross-site requests judged by the resource isolation policy. A remote attacker can cause the victim's browser to send a crafted cross-site request to listener URLs to bypass cross-site request forgery protections and perform actions in the victim's session.

Requests using simple top-level GET navigations or requests from same-site sibling origins may be accepted, and exploitation relies on the victim's browser sending the user's session cookies with the request.


4) Cross-site scripting (CVE-ID: CVE-2026-76986)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script code in the victim's browser.

The vulnerability exists due to improper neutralization of input during web page generation in org.apache.wicket.markup.html.form.AbstractSingleSelectChoice when rendering the default option body from getNullValidDisplayValue() or getNullKeyDisplayValue(). A remote attacker can supply crafted data that is written into the markup without escaping to execute arbitrary script code in the victim's browser.

Applications are affected when they override those methods to return attacker-influenced data, or when their nullValid or null bundle entry contains such data. RadioChoice is not affected.


5) Cross-site scripting (CVE-ID: CVE-2026-76985)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script code in the victim's browser.

The vulnerability exists due to improper neutralization of input during web page generation in Palette option rendering in org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions when writing additional attributes into

Only applications that override Palette.getAdditionalAttributesForChoices, Palette.getAdditionalAttributesForSelection, or AbstractOptions.getAdditionalAttributes and return attacker-influenced data are affected.


6) Cross-site scripting (CVE-ID: CVE-2026-76984)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script code in the victim's browser.

The vulnerability exists due to improper neutralization of input during web page generation in org.apache.wicket.markup.head.MetaDataHeaderItem when generating and tags with attacker-influenced attribute values. A remote attacker can supply a crafted attribute value containing a double quote to inject additional attributes and execute arbitrary script code in the victim's browser.

An application is affected only if it passes attacker-influenced data to addTagAttribute or the forMetaTag or forLinkTag factory methods. A value may be provided through an IModel rather than as a literal.


7) Cross-site scripting (CVE-ID: CVE-2026-76983)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script code in the victim's browser.

The vulnerability exists due to improper neutralization of input during web page generation in AutoLabelTextResolver when rendering a form component label supplied through FormComponent.setLabel(IModel). A remote attacker can supply crafted label content to execute arbitrary script code in the victim's browser.

An application is affected only if a form component label contains data that can be influenced by an attacker, whether from a request or from stored data.


8) Cross-site scripting (CVE-ID: CVE-2026-76982)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script code in the victim's browser.

The vulnerability exists due to improper neutralization of input during web page generation in org.apache.wicket.markup.html.form.Button when rendering a Button component as a <button> element with an attacker-influenced model object. A remote attacker can supply crafted markup in the model value to execute arbitrary script code in the victim's browser.

The issue affects Button and the subclasses AjaxButton, AjaxFallbackButton, and WizardButton when the application renders them as <button> elements instead of <input> elements.


9) Cross-site scripting (CVE-ID: CVE-2026-75802)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.

The vulnerability exists due to improper neutralization of input during web page generation in AjaxEditableChoiceLabel, AjaxEditableLabel, and AjaxEditableMultiLineLabel when rendering attacker-influenced label values. A remote attacker can supply crafted choice, model, or null-label data to execute arbitrary script in the victim's browser.

Only the label rendering is affected; the dropdown editor escapes the same renderer value when displaying it as an option. Applications are affected for empty-model rendering only if defaultNullLabel() is overridden to return an attacker-influenced value.


Remediation

Install update from vendor's website.

References