EUVD-2026-114899

Files accessible to external parties in Apache Wicket. org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that separates a static HTML file, which may be...

EUVD-2026-114900

Incorrect behavior order in Apache Wicket: a file path is validated before the framework appends the attributes that complete it. org.apache.wicket.request.resource.PackageResource asks the configured package resource guard about a path built from the scope class' package and the file name in the...

CVE-2026-84177

Apache Wicket versions 8.0.0–8.19.0 , 9.0.0–9.24.0 , and 10.0.0–10.11.0 are vulnerable to a CWE-179 incorrect behavior order flaw. The PackageResource component validates a file path before the framework appends attributes (style, variation, and locale) decoded from query parameters. If a compone...