Improper Input Handling in Apache Wicket Affects Various Versions

CVE-2026-83539

What is CVE-2026-83539?

A vulnerability in Apache Wicket involves improper neutralization of input during web page generation, where user-generated text can become an executable URL. Specifically, the components SmartLinkLabel and SmartLinkMultiLineLabel turn detected URLs into anchors, but do not restrict the URL schemes. As a result, an attacker could craft a link that executes harmful scripts when clicked. This issue is particularly concerning for applications that render untrusted input, as the default Content-Security-Policy for newer versions mitigates the risk of script execution but is absent in version 8.x. Users are advised to upgrade to patched versions to secure against this threat.

References