CVE-2026-70449

Name of the Vulnerable Software and Affected Versions Apache Wicket versions prior to 8.19.0 Apache Wicket versions prior to 9.24.0 Apache Wicket versions prior to 10.11.0

Description Improper validation of resource URL attributes allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the servlet container would not otherwise serve. The locale, style, and variation attributes decoded from a package resource URL are spliced into the resource lookup path without being checked for path separators. Because the IPackageResourceGuard and WebApplicationPath do not inspect the attacker-controlled portion of the path, a crafted request can escape the intended package directory on servlet containers that normalize .. in ServletContext.getResource(). The readable files are limited to extensions permitted by the configured IPackageResourceGuard. Applications using the blocklist-based PackageResourceGuard or custom patterns may disclose configuration files such as web.xml. Additionally, the lookup process can act as an existence oracle for arbitrary paths.

Recommendations Upgrade to version 8.19.0. Upgrade to version 9.24.0. Upgrade to version 10.11.0.