Executive brief
Apache Wicket is a Java web framework used to build interactive web applications. The framework's file upload validation can be bypassed if the HTTP request body is pre-parsed by another component (such as Spring Boot or a servlet filter), allowing attackers to upload files larger than configured limits or upload more files than permitted. This could lead to disk space exhaustion, application denial of service, or other resource-based attacks.
Technical details
The vulnerability is a validation bypass in Apache Wicket's multipart request handling. When Commons FileUpload returns no items (because the request body was already consumed by a prior component), Wicket falls back to HttpServletRequest#getParts(). In this fallback path, per-file size limits (Form#setFileMaxSize) and file count limits (Form#setFileCountMax) are not enforced, even though they are configured. The total upload size limit (Form#setMaxSize) remains enforced via Content-Length header validation. The vulnerability requires the request body to be pre-parsed by an upstream component (servlet with @MultipartConfig, Spring Boot multipart resolver, or filter calling getParameter()), and affects Wicket file upload components including Form with FileUploadField, FileUploadToResourceField, and AjaxFileDropBehavior. Patches are available in versions 8.19.0, 9.24.0, and 10.11.0.
Affected products
- Apache Wicket 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, 10.0.0 through 10.10.0
Timeline
- 2026-08-31: disclosed