Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application,… (CVE-2026-70449)

The vulnerability in Apache Wicket involves improper validation of resource URL attributes (locale, style, variation) that are decoded and spliced into the resource lookup path without checking for path separators. The IPackageResourceGuard and WebApplicationPath controls do not inspect these attacker-controlled portions, allowing crafted requests to escape the intended package directory on servlet containers that normalize '..' in ServletContext.getResource(). This enables unauthenticated remote attackers to read files from the web application, including protected files under WEB-INF. The default SecurePackageResourceGuard restricts accessible file extensions to common web assets, but custom or blocklist-based guards may expose sensitive configuration files such as web.xml. The vulnerability affects Apache Wicket 8.18.0 and earlier, 9.23.0 and earlier, and 10.10.0 and earlier. Fixed versions are 8.19.0, 9.24.0, and 10.11.0.

An unauthenticated remote attacker can read files from the web application, including files under WEB-INF that are normally inaccessible. The extent of file disclosure depends on the IPackageResourceGuard configuration; default settings limit exposure to certain web asset file types, while custom configurations may allow disclosure of sensitive configuration files. Additionally, the vulnerability allows an existence oracle for arbitrary paths, potentially aiding further attacks.

Users should upgrade Apache Wicket to versions 8.19.0, 9.24.0, or 10.11.0 or later, which contain fixes for this vulnerability. Users of unsupported versions 7.x or older should upgrade to a supported version. No other mitigations are indicated in the advisory.