Path traversal in Apache Wicket - CVE-2026-43975
Published: August 25, 2026
Vulnerability identifier: #VU145309
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-43975
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to write arbitrary files outside the intended upload directory or read files from arbitrary locations on the server.
The vulnerability exists due to improper input validation in FolderUploadsFileManager when processing the uploadFieldId parameter or the clientFileName before constructing file paths. A remote attacker can send crafted input to write arbitrary files outside the intended upload directory or read files from arbitrary locations on the server.
Affected software
Apache Wicket
How to mitigate CVE-2026-43975
Install security update from vendor's website.
Apache Wicket - update to 10.9.0