CVE-2026-43975: Apache Wicket Path Traversal Vulnerability in File Uploads
Summary
CVE-2026-43975: Apache Wicket has a Path Traversal issue. Affects org.apache.wicket:wicket-core across 3 version ranges.
>= 8.0.0-M1, <= 8.17.0
>= 9.0.0-M1, <= 9.22.0
>= 10.0.0-M1, < 10.9.0
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Wicket is a popular open-source web application framework for Java that simplifies the development of web applications by providing a component-based architecture. It allows developers to create dynamic web pages with reusable components, making it easier to manage complex user interfaces. However, certain versions of Apache Wicket are vulnerable to a path traversal issue that can lead to unauthorized file access and manipulation.
Vulnerability Detail
The vulnerability arises from the FolderUploadsFileManager component in Apache Wicket, which fails to validate or sanitize the 'uploadFieldId' parameter and the 'clientFileName' before constructing file paths. This oversight allows an unauthenticated attacker to write arbitrary files outside the intended upload directory or read files from arbitrary locations on the server. The affected versions include Apache Wicket from 8.0.0 through 8.17.0, from 9.0.0 through 9.22.0, and from 10.0.0 through 10.8.0.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement additional validation and sanitization of the 'uploadFieldId' and 'clientFileName' parameters in your application code to prevent unauthorized file access. However, upgrading to the patched version is strongly recommended for a permanent fix.
Conclusion
The Apache Wicket path traversal vulnerability (CVE-2026-43975) poses a significant risk to applications using affected versions of the framework. It is crucial for users to upgrade to version 10.9.0 or later to mitigate this risk effectively. Implementing additional validation can serve as a temporary measure, but upgrading remains the most reliable solution.
See every vulnerability recorded for org.apache.wicket:wicket-core →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
The affected versions include Apache Wicket from 8.0.0 through 8.17.0, from 9.0.0 through 9.22.0, and from 10.0.0 through 10.8.0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
An attacker could exploit this vulnerability to write arbitrary files to the server or read sensitive files, potentially leading to data breaches or server compromise.
While upgrading is the best solution, you can implement additional validation and sanitization of file upload parameters as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.wicket:wicket-core.
