Improper Resource URL Validation in Apache Wicket by The Apache Software Foundation

CVE-2026-70449

What is CVE-2026-70449?

The vulnerability arises from inadequate validation of resource URL attributes in Apache Wicket, permitting an unauthenticated remote attacker to access sensitive files. This occurs when locale, style, and variation attributes are concatenated into the resource path without proper checks for malicious input, including path separators. Consequently, an attacker can exploit this flaw to read files from the web application that should remain inaccessible, such as configuration files under the WEB-INF directory. Although the IPackageResourceGuard is meant to restrict access, it fails to adequately inspect the user-controlled segments of paths. Users are urged to update to newer versions (8.19.0, 9.24.0, or 10.11.0) to mitigate this issue.

References