Executive brief
Apache Wicket is a popular Java web application framework used to build server-side rendered web pages. A vulnerability in the form handling component fails to properly escape user-influenced text in dropdown lists and other choice controls, allowing attackers to inject malicious scripts that execute in users' browsers. This could lead to session hijacking, credential theft, or defacement of web pages.
Technical details
The vulnerability is an improper neutralization of input (cross-site scripting / XSS) in AbstractSingleSelectChoice, the base class for DropDownChoice. While all regular options are escaped according to the escape-model-strings setting, the default option body (displayed when no choice is selected) is rendered unescaped into the HTML markup. The text comes from getNullValidDisplayValue() or getNullKeyDisplayValue() methods, which are protected and can be overridden by applications. If an application overrides these methods to return attacker-influenced data, or if custom bundle entries contain such data, malicious scripts can be injected. No authentication is required; an attacker only needs to control the content of these fields. RadioChoice is not affected as it overrides the vulnerable method to emit no default option.
Affected products
- Apache Wicket 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, 10.0.0 through 10.10.0, and 1.5.0 onwards in unsupported releases
Timeline
- 2026-08-31: disclosed
- 2026: patched: Fixed in versions 8.19.0, 9.24.0, and 10.11.0