CVE-2026-84172

Apache Wicket is vulnerable to a file disclosure issue where component markup is served as a package resource. The root cause lies in org.apache.wicket.markup.html.PackageResourceGuard; when wicket-core is loaded by a class loader that cannot see the application's classes (e.g., in shared library...