CVE-2026-70449

Apache Wicket is affected by a path traversal vulnerability in its package resource URL handling. The locale, style, and variation attributes decoded from a resource URL are spliced into the lookup path without being checked for path separators, and the existing controls (IPackageResourceGuard an...

GHSA-GWCR-J4WH-J3CQ Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability

Requests to the ConcatServlet and WelcomeFilter are able to access protected resources within the WEB-INF directory. For example a request to the ConcatServlet with a URI of /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the...