Skip to content
OpenAdvisories
High WID-SEC-2026-3091 9 CVEs

Apache Wicket: Mehrere Schwachstellen

Published Aug 30, 2026 · Updated Aug 31, 2026 · Revision 2 · de-DE

Vendor: Apache Product: Wicket Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Wicket ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

Apache Wicket ist ein komponentenbasiertes Web-Framework für die Programmiersprache Java.

Vulnerabilities 9

  • High 7.5
    CVE-2026-71257

    Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed

    Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request with Apache Commons FileUpload. If the request body has already been consumed by another component, Commons FileUpload returns no items and Wicket …

    Apache Software Foundation Apache Wicket
  • Medium 6.1
    CVE-2026-76986

    Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue

    Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of DropDownChoice, writes the body of the default option — the entry shown when no choice is selected —…

    Apache Software Foundation Apache Wicket
  • Medium 5.3
    CVE-2026-70449

    Apache Wicket: Path traversal in resource style/variation/locale

    Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the servlet container would not otherwise serve. The locale, style and variati…

    Apache Software Foundation Apache Wicket
  • Medium 5.1
    CVE-2026-75802

    Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel

    AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model valu…

    Apache Software Foundation Apache Wicket
  • Medium 5.1
    CVE-2026-76982

    Apache Wicket: XSS in Button via its model object

    Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag already …

    Apache Software Foundation Apache Wicket
  • Medium 5.1
    CVE-2026-76983

    Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel

    Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The resolver writes the label…

    Apache Software Foundation Apache Wicket
  • Medium 5.1
    CVE-2026-76984

    Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute

    Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHeaderItem generates <meta> and <link> header tags. It escaped the attribute names it wrote, but ran the attribute values through a replacement…

    Apache Software Foundation Apache Wicket
  • Medium 5.1
    CVE-2026-76985

    Apache Wicket: XSS in Palette via getAdditionalAttributes

    Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display value of each option…

    Apache Software Foundation Apache Wicket
  • Medium 4.6
    CVE-2026-71378

    Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener

    ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin. Its default policy, FetchMetadataResourceIsolationPolicy, was der…

    Apache Software Foundation Apache Wicket

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-68491, EUVD-2026-68490, EUVD-2026-68489, EUVD-2026-68488, EUVD-2026-68486, EUVD-2026-68484, EUVD-2026-68487, EUVD-2026-68516, EUVD-2026-68517

  2. #1

    Initiale Fassung

References