Executive brief
Apache Wicket, a popular framework for building Java web applications, contains a security flaw in its file management component. An unauthenticated attacker can exploit this to read sensitive files from the server or write malicious files into unauthorized locations. This could lead to the theft of private data or allow an attacker to gain control over the web server by uploading malicious scripts.
Technical details
A path traversal vulnerability exists in the FolderUploadsFileManager component of Apache Wicket. The vulnerability stems from a failure to validate or sanitize the 'uploadFieldId' HTTP query parameter and the 'clientFileName' field within AJAX-based file upload requests. An unauthenticated remote attacker can use traversal sequences (e.g., '../') to escape the intended upload directory. This allows for arbitrary file writes, potentially leading to Remote Code Execution (RCE) via JSP webshells, and arbitrary file reads from the server's filesystem. The issue is fixed in version 10.9.0.
Affected products
- Apache Wicket 8.0.0 through 8.17.0, 9.0.0 through 9.22.0, 10.0.0 through 10.8.0
Timeline
- 2026-04-21: other: Vulnerability reported via pull request
- 2026-04-27: patched: Fix merged into master branch
- 2026-05-06: disclosed: Public advisory released
- 2026-05-06: advisory: NVD publication