Executive brief
Apache Wicket is a popular Java web application framework used to build dynamic web applications. A path traversal vulnerability allows unauthenticated attackers to read sensitive files from the web application server, including files that should not be publicly accessible. This could expose configuration files, source code, or other sensitive data depending on file types the application permits.
Technical details
The vulnerability is a path traversal flaw in Apache Wicket's package resource URL handling. Attacker-controlled locale, style, and variation attributes are concatenated into the resource lookup path without validation for path separators (../) before being processed. The existing security guards (IPackageResourceGuard and WebApplicationPath) check only the base resource name and do not inspect the attacker-supplied attributes, allowing traversal outside the intended package directory. On servlet containers that normalize .. sequences, a crafted resource request can escape restrictions and read files with permitted extensions (js, css, images, etc. by default). The vulnerability affects versions 8.18.0 and earlier, 9.23.0 and earlier, and 10.10.0 and earlier. Patches are available in versions 8.19.0, 9.24.0, and 10.11.0.
Affected products
- Apache Wicket 8.18.0 and before, 9.23.0 and before, 10.10.0 and before
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Patches released: version 8.19.0, 9.24.0, 10.11.0