CVE-2026-84177

Apache Wicket versions 8.0.0–8.19.0 , 9.0.0–9.24.0 , and 10.0.0–10.11.0 are vulnerable to a CWE-179 incorrect behavior order flaw. The PackageResource component validates a file path before the framework appends attributes (style, variation, and locale) decoded from query parameters. If a compone...