CVE-2026-70449: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Apache Software Foundation Apache Wicket

CVE-2026-70449 is a path traversal vulnerability in Apache Wicket caused by improper validation of locale, style, and variation attributes in package resource URLs. These attributes are appended to the resource lookup path without checking for path separators, allowing crafted requests to bypass directory restrictions and access files outside the intended package directory. The IPackageResourceGuard and WebApplicationPath controls do not inspect these appended attacker-controlled path segments, leading to potential unauthorized file reads. The vulnerability affects Apache Wicket versions 8.18.0 and earlier, 9.23.0 and earlier, and 10.10.0 and earlier. The default SecurePackageResourceGuard restricts accessible file extensions, but custom configurations may increase exposure. The issue is fixed in versions 8.19.0, 9.24.0, and 10.11.0.

An unauthenticated remote attacker can read files from the web application, including some files under WEB-INF that are normally protected by the servlet container. The set of files accessible depends on the configured IPackageResourceGuard, with the default guard limiting access to certain static resource file types. Applications with custom or blocklist-based guards may expose additional sensitive files such as configuration files (e.g., web.xml). The vulnerability does not allow modification or denial of service but can disclose sensitive information.

Users should upgrade Apache Wicket to versions 8.19.0, 9.24.0, or 10.11.0 or later, which contain fixes for this vulnerability. Users of unsupported versions (7.x or older) should upgrade to a supported fixed version. No other mitigations are indicated. Patch status is confirmed by the vendor advisory recommending these fixed versions.