CVE-2026-76986 is a cross-site scripting (XSS) vulnerability in Apache Wicket affecting versions from 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0. The issue arises because the default option body in select components is not escaped properly when overridden by an application, allowing potentially attacker-controlled data to be injected into web pages. Apache Wicket versions 8.19.0, 9.24.0, and 10.11.0 or later fix this issue. The vulnerability has a CVSS score of 6.1, indicating medium severity.
CVE-2026-76983 is a cross-site scripting (XSS) vulnerability in Apache Wicket affecting versions from 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0. The issue arises because the <wicket:label> tag renders label content without escaping, allowing untrusted input to be interpreted as markup. This affects applications where form component labels can be influenced by attackers. There is no workaround, but upgrading to Apache Wicket versions 8.19.0, 9.24.0, or 10.11.0 resolves the issue.
CVE-2026-76984 is a cross-site scripting (XSS) vulnerability in Apache Wicket affecting versions from 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0. The issue arises from improper escaping of attribute values in meta and link header tags, allowing injection of malicious content if an attacker can control attribute values containing double quotes. The vulnerability is fixed in versions 8.19.0, 9.24.0, and 10.11.0.
CVE-2026-76982 is a cross-site scripting (XSS) vulnerability in Apache Wicket affecting versions from 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0. The issue arises because the Button component clears the escape-model-strings flag for attribute encoding but does not encode the element body when rendering a <button> element, allowing unescaped markup from the model to be rendered. This can lead to XSS if an attacker can influence the model data rendered inside a <button> element. The vulnerability affects Button and its subclasses AjaxButton, AjaxFallbackButton, and WizardButton. Users are recommended to upgrade to fixed versions 8.19.0, 9.24.0, or 10.11.0.
CVE-2026-71378 is a Cross-Site Request Forgery (CSRF) vulnerability in Apache Wicket's ResourceIsolationRequestCycleListener, affecting versions 9.1.0 through 9.23.0 and 10.0.0 through 10.10.0. The default resource isolation policy allows unsafe cross-origin and same-site requests that can be exploited to invoke component listeners within an authenticated session. This can enable an attacker controlling a page or a sibling origin to perform actions on behalf of a user. Versions prior to 9.1.0 are not affected as the vulnerable classes do not exist. The issue is fixed in versions 9.24.0 and 10.11.0.
Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request with Apache Commons FileUpload. If the request body has already been consumed by another component, Commons FileUpload returns no items and Wicket falls back to reading the upload through HttpServletRequest#getParts(). The per-file size limit (for example Form#setFileMaxSize) and the file count limit (Form#setFileCountMax) are not applied to the parts obtained that way, and no exception is raised, so the upload is processed as though those limits had been satisfied. A remote uploader can therefore submit files that are larger, or more numerous, than the application permits, up to whatever the component that parsed the request allows. A part carrying no Content-Type header is additionally read into memory in full during parsing, so the size of that allocation is determined by the request and bounded only by those same external limits.
The total upload size limit (Form#setMaxSize) is not affected. Commons FileUpload compares the declared Content-Length against it before reading the body, so a request declaring an oversized length is rejected before the fallback is reached.
The fallback is reached in deployments where a servlet or filter has already parsed the request body — for example a servlet annotated with @MultipartConfig, Spring Boot's multipart resolver, or any filter that calls HttpServletRequest#getParameter() on a multipart request. It applies to the Wicket components that accept uploads on that path, including Form with FileUploadField, FileUploadToResourceField and AjaxFileDropBehavior. Applications that configure neither a per-file nor a file-count limit are not affected, as Wicket applies neither by default.
This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0.
Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. As a workaround, configure equivalent limits in the component that parses the request — for example spring.servlet.multipart.max-file-size and max-request-size, or maxFileSize and maxRequestSize in @MultipartConfig or in the web.xml <multipart-config> element.
Apache Wicket versions up to 8.18.0, 9.23.0, and 10.10.0 contain a path traversal vulnerability due to improper validation of resource URL attributes. This flaw allows unauthenticated remote attackers to read certain files from the web application, including some under WEB-INF that are normally protected. The vulnerability arises because attacker-controlled path components are appended after initial security checks, enabling crafted requests to escape intended directory restrictions. The default resource guard limits accessible file types, but custom configurations may expose sensitive configuration files. Fixed versions are 8.19.0, 9.24.0, and 10.11.0.
Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket.
This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0.
Users are recommended to upgrade to version 10.10.0, which fixes the issue.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket.
This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0.
Users are recommended to upgrade to version 10.10.0, which fixes the issue.
Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.
This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.
Users are recommended to upgrade to version 10.9.0, which fixes the issue.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket.
This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.
Users are recommended to upgrade to version 10.9.0, which fixes the issue.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket.
This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9.0.0 through 9.22.0, from 10.0.0 through 10.8.0.
Users are recommended to upgrade to version 10.9.0, which fixes the issue.
FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the clientFileName
before constructing file paths, allowing an unauthenticated attacker to
write arbitrary files outside the intended upload directory or read
files from arbitrary locations on the server.
This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9.0.0 through 9.22.0, from 10.0.0 through 10.8.0.
Users are recommended to upgrade to version 10.9.0, which fixes the issue.