GitHub Advisoryadvisory · Maven

GHSA-3gmf-p6r4-q8m6 Apache Wicket has a Path Traversal issue

MEDIUM Published 2026-05-06 Modified 2026-05-11 Official page ↗
Aliases
CVE-2026-43975
Ecosystem
Maven
Packages
org.apache.wicket:wicket-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-22
Reviewed
2026-05-11

Affected packages

• Maven org.apache.wicket:wicket-core: >= 8.0.0-M1, <= 8.17.0 (no fix yet) • Maven org.apache.wicket:wicket-core: >= 9.0.0-M1, <= 9.22.0 (no fix yet) • Maven org.apache.wicket:wicket-core: >= 10.0.0-M1, < 10.9.0 → fixed in 10.9.0

Description

FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the clientFileName before constructing file paths, allowing an unauthenticated attacker to write arbitrary files outside the intended upload directory or read files from arbitrary locations on the server. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9.0.0 through 9.22.0, from 10.0.0 through 10.8.0. Users are recommended to upgrade to version 10.9.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2026-43975 FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the clientFileName before… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References