Path traversal in Apache Wicket - CVE-2026-70449
Published: August 31, 2026
Vulnerability identifier: #VU146317
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-70449
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper input validation in package resource URL attribute handling when processing crafted resource requests. A remote attacker can supply crafted locale, style, or variation values containing path separators to disclose sensitive information.
On servlet containers that normalize .. in ServletContext.getResource(), the issue can expose files from the web application, including files under WEB-INF, and the pre-guard lookup acts as an existence oracle for arbitrary paths.
Affected software
Apache Wicket
How to mitigate CVE-2026-70449
Install security update from vendor's website.
Apache Wicket - addressed in versions 8.19.0, 9.24.0, 10.11.0