Read the docs
TI-2026-32020 Aliases CVE-2026-43975GHSA-3gmf-p6r4-q8m6

Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager

Priority LOW 36CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the clientFileName before constructing file paths, allowing an unauthenticated attacker to write arbitrary files outside the intended upload directory or read files from arbitrary locations on the server. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9.0.0 through 9.22.0, from 10.0.0 through 10.8.0. Users are recommended to upgrade to version 10.9.0, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00732 54th percentileScored 2026-11-07
Fix Fixed org.apache.wicket:wicket-core (Maven): 10.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Wicket10.0.0 – 10.8.0; 9.0.0 – 9.22.0; 8.0.0 – 8.17—No fix listedCNA
—org.apache.wicket:wicket-core (Maven)8.0.0-M1 – 8.17.0—No fix listedGHSA-3gmf-p6r4-q8m6
—org.apache.wicket:wicket-core (Maven)9.0.0-M1 – 9.22.0—No fix listedGHSA-3gmf-p6r4-q8m6
—org.apache.wicket:wicket-core (Maven)10.0.0-M1 to before 10.9.010.9.0Patch availableGHSA-3gmf-p6r4-q8m6
  • Apache Wicket VendorApache Affected 10.0.0 – 10.8.0; 9.0.0 – 9.22.0; 8.0.0 – 8.17 Fixed in — No fix listed CNA
  • org.apache.wicket:wicket-core (Maven) Vendor— Affected 8.0.0-M1 – 8.17.0 Fixed in — No fix listed GHSA-3gmf-p6r4-q8m6
  • org.apache.wicket:wicket-core (Maven) Vendor— Affected 9.0.0-M1 – 9.22.0 Fixed in — No fix listed GHSA-3gmf-p6r4-q8m6
  • org.apache.wicket:wicket-core (Maven) Vendor— Affected 10.0.0-M1 to before 10.9.0 Fixed in 10.9.0 Patch available GHSA-3gmf-p6r4-q8m6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:wicket:*:*:*:*:*:*:*:*8.0.0 – 8.17.0; 9.0.0 – 9.22.0; 10.0.0 to before 10.9.0VulnerableApache
  • cpe:2.3:a:apache:wicket:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.17.0; 9.0.0 – 9.22.0; 10.0.0 to before 10.9.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-3gmf-p6r4-q8m6 org.apache.wicket:wicket-core (Maven) Fixed in 10.9.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-43975
  2. 2026-10-03 Alias added: GHSA-3gmf-p6r4-q8m6

References

Patch 1

Advisory 3

Other 2

  • TI-2016-05834 The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows… CVSS 3.0CRITICAL 9.1
  • TI-2026-28853 Apache Wicket: possible session fixation using AuthenticatedWebSession CVSS 3.1CRITICAL 9.1
  • TI-2024-24295 Apache Wicket: Remote code execution via XSLT injection CVSS 3.1CRITICAL 9.8
  • TI-2026-49926 Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed CVSS 3.1HIGH 7.5
  • TI-2021-06275 DNS proxy and possible amplification attack CVSS 3.1HIGH 7.5
  • TI-2016-05847 Cross-site request forgery in Apache Wicket CVSS 3.0HIGH 8.8
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences