Threats tagged 'ghsa-7jw6-8mj7-6rq2'

Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 contain a vulnerability where file path validation occurs before appending style, variation, and locale attributes. This allows an attacker to access component markup templates if the component class name contains underscores and no shorter class name exists. The exposure is limited to developer-authored HTML templates within the component's package and is read-only. No user data or credentials are exposed. The issue is fixed in versions 8.20.0, 9.25.0, and 10.12.0.