CVE-2026-70449

The Apache Wicket framework (specifically the wicket-core package) contains a Directory Traversal vulnerability due to improper validation of resource URL attributes. An unauthenticated remote attacker can read files from the web application, including sensitive resources under WEB-INF, by sendin...

GHSA-GWCR-J4WH-J3CQ Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability

Requests to the ConcatServlet and WelcomeFilter are able to access protected resources within the WEB-INF directory. For example a request to the ConcatServlet with a URI of /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the...