CVE-2026-70449Apache Wicket: Path traversal in resource style/variation/locale
Updated under an hour ago ()
Does this affect you?
It affects Apache Software Foundation Apache Wicket and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the servlet container would not otherwise serve. The locale, style and variation attributes decoded from a package resource URL are spliced into the resource lookup path without being checked for path separators. The IPackageResourceGuard — whose rejection of .. is one of the two intended controls — is applied to the resource name before those attributes are appended, and WebApplicationPath rejects only paths literally beginning with WEB-INF/. Neither control ever inspects the attacker-controlled portion of the path. On servlet containers that normalize .. in ServletContext.getResource(), a crafted request therefore escapes the intended package directory. The set of readable files is limited to the file extensions permitted by the configured IPackageResourceGuard. The default SecurePackageResourceGuard permits only js, css, png, jpg, jpeg, gif, ico, cur, map, html, txt, swf, bmp, svg, avif, eot, ttf, woff and woff2, which excludes configuration formats. Applications that have added patterns to the guard, or replaced it with the blocklist-based PackageResourceGuard, can additionally disclose configuration files such as web.xml. Independently of the extension, the lookup performed before the guard runs acts as an existence oracle for arbitrary paths. This issue affects Apache Wicket 8.18.0 and before, 9.23.0 and before and 10.10.0 and before. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version.
- CVSS
- 5.3 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness (CWE)
- CWE-22
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- apache
- NVD analysis
- Analyzed
- Record last updated
- Aug 31, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Apache Software Foundation Apache Wicket apache_software_foundation:apache_wicket (from the name) | from 8.0.0 through 8.18.0; from 9.0.0 through 9.23.0; from 10.0.0 through 10.10.0 | CNA record |
apache wicket apache:wicket | from 8.0.0 before 8.19.0; from 9.0.0 before 9.24.0; from 10.0.0 before 10.11.0 | NVD |
References
- https://lists.apache.org/thread/f4pb2q2ksdsfv1o315slp36dx66bf5vgvendor-advisory, mailing-list
- http://www.openwall.com/lists/oss-security/2026/08/30/3mailing-list, third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.