Input Manipulation Risk in Apache Wicket Affects Multiple Versions
CVE-2026-76986

6.1MEDIUM

Key Information:

Vendor

Apache
Status
Apache Wicket
Vendor
CVE Published:
31 August 2026

What is CVE-2026-76986?

A vulnerability exists in Apache Wicket where improper neutralization of input during web page generation can lead to security risks. Specifically, in the AbstractSingleSelectChoice class, the default option body may not be properly escaped when no choice is selected. If a web application overrides certain methods and returns user-influenced values, attackers may exploit this flaw. To mitigate this risk, it is recommended to escape values in custom overrides. Users should upgrade to versions 8.19.0, 9.24.0, or 10.11.0 to address this vulnerability.

Affected Version(s)

Apache Wicket 8.0.0 <= 8.18.0

Apache Wicket 9.0.0 <= 9.23.0

Apache Wicket 10.0.0 <= 10.10.0

References

https://lists.apache.org/thread/4qltg6wckqz8wbs1f4jzqlc0y...
vendor-advisory

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Emond Papegaaij
.