Apache Wicket versions 8.0.0 through 8.17.0, 9.0.0 through 9.22.0, and 10.0.0 through 10.8.0 contain a path traversal vulnerability in the FolderUploadsFileManager component. This flaw allows unauthenticated attackers to write files outside the intended upload directory or read arbitrary files on the server by exploiting insufficient validation of the uploadFieldId and clientFileName parameters. The issue is fixed in version 10.9.0.