Executive brief
Apache Wicket is a web application framework widely used to build interactive Java-based web applications. The Button component fails to properly escape user-controllable data when rendered as an HTML button element, allowing attackers to inject malicious markup. This enables cross-site scripting (XSS) attacks that can steal user sessions, redirect users to malicious sites, or perform unauthorized actions on behalf of users.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the org.apache.wicket.markup.html.form.Button class and its subclasses (AjaxButton, AjaxFallbackButton, WizardButton). The constructor disables the escape-model-strings flag to avoid double-encoding when the button renders as an input element, but when the button is attached to a <button> HTML element instead, the model object is written directly into the element body without any encoding. An attacker can exploit this by controlling the model data—either through a request parameter or pre-stored data—to inject arbitrary HTML and JavaScript. The vulnerability requires the application to render a Button component bound to user-controllable data on a <button> element. A temporary workaround is to manually call setEscapeModelStrings(true) on affected buttons. Patched versions are available (8.19.0, 9.24.0, and 10.11.0).
Affected products
- Apache Wicket 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, 10.0.0 through 10.10.0, and older versions from 6.25.0 and 7.5.0 onwards
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Fix available in versions 8.19.0, 9.24.0, and 10.11.0