Improper Input Neutralization in Apache Wicket Affects Web Application Security

CVE-2026-76982

What is CVE-2026-76982?

The vulnerability in Apache Wicket arises from improper neutralization during web page generation, particularly affecting the Button component when used in a element. This flaw allows unsanitized user input to be rendered as markup, potentially leading to cross-site scripting (XSS) attacks. Because Wicket does not validate the source of the model data, an attacker can manipulate model content that may be displayed without appropriate encoding, compromising the application’s security. Affected subclasses, including AjaxButton and WizardButton, similarly exhibit this risk. To mitigate this vulnerability, developers should ensure the use of setEscapeModelStrings(true) for Button components rendering as elements and upgrade to the latest secure versions.

References