EUVD-2026-114899

Files accessible to external parties in Apache Wicket. org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that separates a static HTML file, which may be...

EUVD-2026-114900

Incorrect behavior order in Apache Wicket: a file path is validated before the framework appends the attributes that complete it. org.apache.wicket.request.resource.PackageResource asks the configured package resource guard about a path built from the scope class' package and the file name in the...

Files or Directories Accessible to External Parties

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

CVE-2026-84177

Incorrect behavior order in Apache Wicket: a file path is validated before the framework appends the attributes that complete it. org.apache.wicket.request.resource.PackageResource asks the configured package resource guard about a path built from the scope class' package and the file name in the...

CVE-2026-84172

Files accessible to external parties in Apache Wicket. org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that separates a static HTML file, which may be...

CVE-2026-84177

Apache Wicket versions 8.0.0–8.19.0 , 9.0.0–9.24.0 , and 10.0.0–10.11.0 are vulnerable to a CWE-179 incorrect behavior order flaw. The PackageResource component validates a file path before the framework appends attributes (style, variation, and locale) decoded from query parameters. If a compone...

CVE-2026-84177 Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore

Incorrect behavior order in Apache Wicket: a file path is validated before the framework appends the attributes that complete it. org.apache.wicket.request.resource.PackageResource asks the configured package resource guard about a path built from the scope class' package and the file name in the...

CVE-2026-84172 Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader

Files accessible to external parties in Apache Wicket. org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that separates a static HTML file, which may be...

CVE-2026-84172

Apache Wicket is vulnerable to a file disclosure issue where component markup is served as a package resource. The root cause lies in org.apache.wicket.markup.html.PackageResourceGuard; when wicket-core is loaded by a class loader that cannot see the application's classes (e.g., in shared library...

PT-2026-135051

Files accessible to external parties in Apache Wicket. org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that separates a static HTML file, which may be...

CVE-2026-84172: Apache Software Foundation Apache Wicket: Files accessible to external parties in Apache Wicket

Files accessible to external parties in Apache Wicket. org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that separates a static HTML file, which may be...

CVE-2026-84177: Apache Software Foundation Apache Wicket: Incorrect behavior order in Apache Wicket: a file path is validated before the framework appends the attributes that…

Incorrect behavior order in Apache Wicket: a file path is validated before the framework appends the attributes that complete it. org.apache.wicket.request.resource.PackageResource asks the configured package resource guard about a path built from the scope class' package and the file name in the...

PT-2026-135052

Incorrect behavior order in Apache Wicket: a file path is validated before the framework appends the attributes that complete it. org.apache.wicket.request.resource.PackageResource asks the configured package resource guard about a path built from the scope class' package and the file name in the...

CVE-2026-43646

Apache Wicket is vulnerable to an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. The issue occurs because crafted URLs can bypass the PackageResourceGuard , leading to unauthorized information leakage. This vulnerability affects versions 8.0.0 through 8.17.0 , 9.0.0 thr...