Skip to content
OpenAdvisories
High WID-SEC-2026-4275 19 CVEs

Apache Wicket: Mehrere Schwachstellen

Published Nov 1, 2026 · Updated Nov 1, 2026 · de-DE

Vendor: Apache Product: Wicket Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Wicket ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Daten zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.

Product

Apache Wicket ist ein komponentenbasiertes Web-Framework für die Programmiersprache Java.

Vulnerabilities 19

  • High 8.3
    CVE-2026-83594

    Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names

    Memory allocation with an excessive size value in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.FileUploadToResourceField uploads files to a separately mounted resource rather than through a form, and is told the outcome afterwards over it…

    Apache Software Foundation Apache Wicket
  • High 8.3
    CVE-2026-84170

    Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource

    Allocation of resources without limits or throttling in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.AbstractFileUploadResource is the server side of the form-less upload offered by FileUploadToResourceField, which posts the selected file…

    Apache Software Foundation Apache Wicket
  • High 7.6
    CVE-2026-111089

    Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup

    Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string li…

    Apache Software Foundation Apache Wicket
  • High 7.6
    CVE-2026-82956

    Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name

    Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.ajax.AjaxNewWindowNotifyingBehavior notices that a page instance has been opened in a second browser window or tab. It asks the browser for the value of window.nam…

    Apache Software Foundation Apache Wicket
  • High 7.6
    CVE-2026-95863

    Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup

    Improper neutralization of input during web page generation in Apache Wicket. Apache Wicket generates JavaScript that refers to the elements it renders, and writes into that JavaScript two values it derives itself: a component's markup id, and the input name …

    Apache Software Foundation Apache Wicket
  • High 7.4
    CVE-2026-83539

    Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data

    Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.basic.SmartLinkLabel and org.apache.wicket.extensions.markup.html.basic.SmartLinkMultiLineLabel display a text value and turn any URL they f…

    Apache Software Foundation Apache Wicket
  • High 7.4
    CVE-2026-83559

    Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal

    Improper encoding or escaping of output in Apache Wicket. org.apache.wicket.core.util.string.JavaScriptUtils#escapeQuotes() replaces each single quote in its input with a backslash and a single quote, and each double quote with a backslash and a double quote,…

    Apache Software Foundation Apache Wicket
  • High 7.4
    CVE-2026-84231

    Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag

    Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.link.ExternalLink builds a JavaScript click handler and writes it into the tag's onclick attribute whenever the markup tag the component is bound to is…

    Apache Software Foundation Apache Wicket
  • High 7.2
    CVE-2026-82840

    Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication

    Session fixation in Apache Wicket. org.apache.wicket.authroles.authentication.AuthenticatedWebSession is the authentication base class of Wicket's role-based security module, and its signIn(String, String) method is the entry point through which an applicatio…

    Apache Software Foundation Apache Wicket
  • Medium 6.9
    CVE-2026-82557

    Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission

    Missing authorization in Apache Wicket. org.apache.wicket.markup.html.form.Form resolves the component that submitted a form from the request parameters in Form#onRequest() and passes the result directly to Form#onFormSubmitted(IFormSubmitter). The check that…

    Apache Software Foundation Apache Wicket
  • Medium 6.9
    CVE-2026-82704

    Apache Wicket: A listener is invoked on a page instance the request itself created and never configured

    Missing authorization in Apache Wicket. org.apache.wicket.core.request.handler.ListenerRequestHandler invokes an IRequestListener only when org.apache.wicket.Component#canCallListener() allows it, and that method is isEnabledInHierarchy() && isVisibleInHierar…

    Apache Software Foundation Apache Wicket
  • Medium 6.3
    CVE-2026-82115

    Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource

    Missing authorization in Apache Wicket. org.apache.wicket.protocol.ws.api.WebSocketMessageBroadcastHandler, the request handler Wicket's native WebSocket support uses to deliver an incoming frame, resolves the shared resource named by the client's handshake p…

    Apache Software Foundation Apache Wicket
  • Medium 6.3
    CVE-2026-82705

    Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component

    Missing authorization in Apache Wicket. org.apache.wicket.authorization.IAuthorizationStrategy declares isResourceAuthorized(), and that method has a single enforcement point in the framework: org.apache.wicket.request.handler.resource.ResourceRequestHandler,…

    Apache Software Foundation Apache Wicket
  • Medium 6.3
    CVE-2026-84172

    Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader

    Files accessible to external parties in Apache Wicket. org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that sepa…

    Apache Software Foundation Apache Wicket
  • Medium 6.3
    CVE-2026-84177

    Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore

    Incorrect behavior order in Apache Wicket: a file path is validated before the framework appends the attributes that complete it. org.apache.wicket.request.resource.PackageResource asks the configured package resource guard about a path built from the scope c…

    Apache Software Foundation Apache Wicket
  • Low 2.3
    CVE-2026-82558

    Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke

    Missing authorization in Apache Wicket. org.apache.wicket.protocol.ws.api.WebSocketBehavior, through which Wicket's native WebSocket support hands a message sent by the client to the application, calls its onMessage() callbacks without checking whether the cl…

    Apache Software Foundation Apache Wicket
  • Low 2.3
    CVE-2026-82559

    Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation

    Insufficient session expiration in Apache Wicket. org.apache.wicket.protocol.ws.WebSocketSettings#newWebSocketRequest() wraps the WebSocket upgrade request in an org.apache.wicket.protocol.ws.api.ServletRequestCopy, which is kept for the life of the connectio…

    Apache Software Foundation Apache Wicket
  • Low 2.3
    CVE-2026-87718

    Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates

    Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when deciding whether a req…

    Apache Software Foundation Apache Wicket
  • Low 2.1
    CVE-2026-82898

    Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in

    Incorrect order of security checks in Apache Wicket. org.apache.wicket.protocol.http.ResourceIsolationRequestCycleListener obtains the page a request targets before it consults its resource isolation policies, because those policies are passed that page. Obta…

    Apache Software Foundation Apache Wicket

Revision history

  1. #1

    Initiale Fassung

References