Threats Tagged 'cve-2026-70449'

Apache Wicket versions 8.18.0 and earlier, 9.23.0 and earlier, and 10.10.0 and earlier contain an improper validation vulnerability in resource URL attributes. This flaw allows unauthenticated remote attackers to read files from the web application, including files under WEB-INF that are normally protected by the servlet container. The vulnerability arises because locale, style, and variation attributes are appended to resource paths without proper path separator checks, bypassing intended directory traversal protections. The set of files accessible depends on the configured IPackageResourceGuard, with default settings limiting file types but custom configurations potentially exposing sensitive configuration files. The issue is fixed in Apache Wicket versions 8.19.0, 9.24.0, and 10.11.0.

Apache Wicket versions up to 8.18.0, 9.23.0, and 10.10.0 contain a path traversal vulnerability due to improper validation of resource URL attributes. This flaw allows unauthenticated remote attackers to read certain files from the web application, including some under WEB-INF that are normally protected. The vulnerability arises because attacker-controlled path components are appended after initial security checks, enabling crafted requests to escape intended directory restrictions. The default resource guard limits accessible file types, but custom configurations may expose sensitive configuration files. Fixed versions are 8.19.0, 9.24.0, and 10.11.0.