Skip to content
OpenAdvisories
High · 7.5 CVE-2026-43646 EUVD-2026-27651GHSA-jvv4-8wxx-m5r6

Apache Wicket: crafted URLs can bypass PackageResourceGuard

Published May 6, 2026 · Updated May 6, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Wicket Package: org.apache.wicket:wicket-parent Ecosystem: Maven

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket.

This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9.0.0 through 9.22.0, from 10.0.0 through 10.8.0.

Users are recommended to upgrade to version 10.9.0, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Wicket 8.0.0 – ≤ 8.17.0, 9.0.0 – ≤ 9.22.0, 10.0.0 – ≤ 10.8.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.wicket:wicket-parent >= 8.0.0-M1, <= 8.17.0 — GHSA-jvv4-8wxx-m5r6
Maven org.apache.wicket:wicket-parent >= 9.0.0-M1, <= 9.22.0 — GHSA-jvv4-8wxx-m5r6
Maven org.apache.wicket:wicket-parent >= 10.0.0-M1, < 10.9.0 10.9.0 GHSA-jvv4-8wxx-m5r6

Advisories 1

References