# CVE-2026-43646: Apache Wicket information disclosure in PackageResourceGuard

Source: https://junglewise.ai/threats/cve-2026-43646-apache-wicket-information-disclosure-in-packageresourceguard  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-06. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-43646 · Severity: high · CVSS 7.5 · Published 2026-05-06

Apache Wicket, a popular framework for building Java web applications, contains a security flaw that could allow unauthorized access to sensitive files. By using specially crafted web addresses, an attacker can bypass security filters intended to protect internal application resources. This could lead to the exposure of private configuration data or proprietary application code, potentially compromising the entire system.

Technologies: [Apache Wicket](https://junglewise.ai/threats/technologies/apache-wicket), [Apache Software Foundation Wicket](https://junglewise.ai/threats/technologies/wicket). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-43646 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43646 being exploited in the wild.

**How severe is CVE-2026-43646?** High severity, with a CVSS score of 7.5, published 6 May 2026.

**Which products and versions are affected?** Apache Software Foundation Wicket 8.0.0 through 8.17.0, 9.0.0 through 9.22.0, 10.0.0 through 10.8.0; org.apache.wicket:wicket-parent (Maven) ECOSYSTEM:introduced=8.0.0-M1,last_affected=8.17.0.

**Is there a fix for CVE-2026-43646?** A patch was published on 2026-05-06: Version 10.9.0 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43646 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-43646?** Check whether you run Apache Wicket, Apache Software Foundation Wicket or org.apache.wicket:wicket-parent (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in Apache Wicket's PackageResourceGuard component (CWE-200). The flaw allows a remote, unauthenticated attacker to bypass the guard's restrictions using crafted URLs to access resources that should be protected. This bypass enables the retrieval of sensitive files from the application's classpath or package resources. The issue affects multiple major versions (8.x, 9.x, and 10.x) and is resolved in version 10.9.0. Exploitation does not require user interaction or special privileges.

## Affected products

- Apache Wicket 8.0.0 through 8.17.0, 9.0.0 through 9.22.0, 10.0.0 through 10.8.0

## Identifiers

- CVE-2026-43646
- GHSA-jvv4-8wxx-m5r6

## Timeline

- 2026-05-05: disclosed: Initial disclosure on oss-security mailing list
- 2026-05-06: advisory: NVD and GitHub Advisory published
- 2026-05-06: patched: Version 10.9.0 released to address the vulnerability

## References

- [https://lists.apache.org/thread/6zqcvjyz4lsqty1z2g5hg7pl5fqk88rs](https://lists.apache.org/thread/6zqcvjyz4lsqty1z2g5hg7pl5fqk88rs)
- [http://www.openwall.com/lists/oss-security/2026/05/06/3](http://www.openwall.com/lists/oss-security/2026/05/06/3)

## Related threats

- [Apache Wicket improper input neutralization in JavaScript generation](https://junglewise.ai/threats/cve-2026-95863-improper-neutralization-of-input-during-web-page-generation-in)
- [Apache Wicket missing Content-Security-Policy headers with nested request handler delegates](https://junglewise.ai/threats/cve-2026-87718-apache-wicket-10-10-0-10-11-0-and-9-24-0-do-not-set-the-content)
- [Apache Wicket ExternalLink reflected XSS in onclick attribute](https://junglewise.ai/threats/cve-2026-84231-improper-neutralization-of-input-during-web-page-generation-in)
- [Apache Wicket path validation bypass in package resource handling](https://junglewise.ai/threats/cve-2026-84177-incorrect-behavior-order-in-apache-wicket-a-file-path-is)
- [Apache Wicket template disclosure via class loader misconfiguration](https://junglewise.ai/threats/cve-2026-84172-files-accessible-to-external-parties-in-apache-wicket-org-apache)