Description

Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the servlet container would not otherwise serve. The locale, style and variation attributes decoded from a package resource URL are spliced into the resource lookup path without being checked for path separators. The IPackageResourceGuard — whose rejection of .. is one of the two intended controls — is applied to the resource name before those attributes are appended, and WebApplicationPath rejects only paths literally beginning with WEB-INF/. Neither control ever inspects the attacker-controlled portion of the path. On servlet containers that normalize .. in ServletContext.getResource(), a crafted request therefore escapes the intended package directory. The set of readable files is limited to the file extensions permitted by the configured IPackageResourceGuard. The default SecurePackageResourceGuard permits only js, css, png, jpg, jpeg, gif, ico, cur, map, html, txt, swf, bmp, svg, avif, eot, ttf, woff and woff2, which excludes configuration formats. Applications that have added patterns to the guard, or replaced it with the blocklist-based PackageResourceGuard, can additionally disclose configuration files such as web.xml. Independently of the extension, the lookup performed before the guard runs acts as an existence oracle for arbitrary paths. This issue affects Apache Wicket 8.18.0 and before, 9.23.0 and before and 10.10.0 and before. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-31T12:17:56.493Z",
  "pubdate": "2026-08-31T12:17:56.493Z",
  "executiveSummary": "This vulnerability is an improper validation of resource URL attributes in Apache Wicket, leading to unauthorized file disclosure via directory traversal.\nThe flaw allows an unauthenticated remote attacker to bypass intended path restrictions and read sensitive files from the web application, including contents within the protected WEB-INF directory.\nThe vulnerability stems from insufficient sanitization of locale, style, and variation attributes within package resource URLs, which are processed by the application's resource lookup mechanism.\nThe impact depends on the configured IPackageResourceGuard; while default configurations restrict access based on file extensions, improper guard implementations or expanded permit patterns may allow the exfiltration of critical configuration files such as web.xml.\nThe vulnerability also functions as an existence oracle, enabling attackers to probe for arbitrary file paths on the host system regardless of extension-based read restrictions.\nAffected products include Apache Wicket versions 8.18.0 and before, 9.23.0 and before, and 10.10.0 and before.\nExploitation requires no authentication and relies on the normalization behavior of the underlying servlet container to escape the target package directory.\nThe primary risk is unauthorized data exposure, necessitating immediate upgrades to version 8.19.0, 9.24.0, or 10.11.0.",
  "technicalDetails": "The root cause of this vulnerability is the improper handling of decoded attributes within package resource URLs. Specifically, the locale, style, and variation attributes are concatenated into the resource lookup path without adequate validation for path traversal characters, such as directory separators or dot-dot-slash sequences.\nThe vulnerability exists in the interaction between the IPackageResourceGuard and the resource path resolution logic. The IPackageResourceGuard is designed to intercept and validate resource requests, but it performs this validation on the resource name before the potentially malicious attributes are appended. Consequently, the guard fails to inspect the attacker-controlled portions of the path.\nFurthermore, the WebApplicationPath component only implements a rudimentary check that rejects paths strictly beginning with 'WEB-INF/'. This check is easily bypassed because it does not account for paths that traverse into 'WEB-INF/' using relative path normalization.\nThe exploitation flow proceeds as follows: An unauthenticated attacker crafts a request to the web application containing a specifically engineered package resource URL. By injecting sequence characters (such as '../') into the locale, style, or variation attributes, the attacker forces the application to resolve a path outside the intended package directory. When the underlying servlet container invokes ServletContext.getResource(), it normalizes these sequences, effectively escaping the confined directory and accessing protected files.\nThe scope of the impact is constrained by the effective configuration of the IPackageResourceGuard. By default, the SecurePackageResourceGuard limits readable files to a specific list of harmless extensions (e.g., js, css, png). However, if the application employs a less restrictive configuration, such as the blocklist-based PackageResourceGuard or custom patterns, the attacker may exfiltrate sensitive configuration files like web.xml.\nBeyond file content disclosure, the vulnerability acts as a functional existence oracle. Because the initial lookup process occurs before the security guard, the application may reveal whether a file exists at a given path based on differences in request processing, aiding an attacker in mapping the server filesystem or identifying components.\nThis vulnerability affects Apache Wicket versions 8.18.0 and earlier, 9.23.0 and earlier, and 10.10.0 and earlier. It requires no specialized privileges, making it a critical risk for deployments accessible over the network."
}