Skip to content
OpenAdvisories
High WID-SEC-2026-1380 4 CVEs

Apache Wicket: Mehrere Schwachstellen

Published May 5, 2026 · Updated May 6, 2026 · Revision 2 · de-DE

Vendor: Apache Product: Wicket Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Wicket ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.

Product

Apache Wicket ist ein komponentenbasiertes Web-Framework für die Programmiersprache Java.

Vulnerabilities 4

  • Critical 9.1
    CVE-2026-40010

    Apache Wicket: possible session fixation using AuthenticatedWebSession

    Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0. Users …

    Apache Software Foundation Apache Wicket org.apache.wicket:wicket-auth-roles Maven
  • High 7.5
    CVE-2026-43646

    Apache Wicket: crafted URLs can bypass PackageResourceGuard

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9.0.0 through 9.22.0, from 10.0.0 through 10.8.0. Users are recommended to upgrade to version 10.9.0, …

    Apache Software Foundation Apache Wicket org.apache.wicket:wicket-parent Maven
  • Medium 6.5
    CVE-2026-43975

    Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager

    FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the clientFileName before constructing file paths, allowing an unauthenticated attacker to write arbitrary files outside the intended upload directory or re…

    Apache Software Foundation Apache Wicket org.apache.wicket:wicket-core Maven
  • Medium 6.1
    CVE-2026-42509

    Apache Wicket: crafted strings can break out of the JavaScript sequence

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0. Users are recommended to upgrade to version 10…

    Apache Software Foundation Apache Wicket org.apache.wicket:wicket-parent Maven

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-27554, EUVD-2026-27653, EUVD-2026-27556, EUVD-2026-27651

  2. #1

    Initiale Fassung

References