PT-2026-37432 · Apache · Apache Wicket

Pedro Henrique Oliveira Dos Santos · Published 2026-05-06 · Updated 2026-05-07 · CVE-2026-43975

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 8.0.0 through 8.17.0 Apache Wicket versions 9.0.0 through 9.22.0 Apache Wicket versions 10.0.0 through 10.8.0

Description FolderUploadsFileManager fails to validate or sanitize the uploadFieldId parameter or the clientFileName before constructing file paths. This allows an unauthenticated attacker to write arbitrary files outside the intended upload directory or read files from arbitrary locations on the server.

Recommendations Upgrade to version 10.9.0.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-43975

GHSA-3GMF-P6R4-Q8M6

Affected Products

Apache Wicket

References · 13

• https://github.com/apache/wicket/pull/1432 · Patch
• https://lists.apache.org/thread/xp2jrdk6ppv1zcmxb4w1mk2lg1dw3hbr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43975 · Security Note
• https://osv.dev/vulnerability/GHSA-3gmf-p6r4-q8m6 · Vendor Advisory
• https://github.com/apache/wicket/commit/72470983f689c61e6a6c0b7388ef955f23bb1e16 · Note
• https://github.com/apache/wicket · Note
• https://t.me/cveNotify/162356 · Telegram Post
• http://openwall.com/lists/oss-security/2026/05/06/4 · Note
• https://twitter.com/infoflowcloud/status/2051998157614006627 · Twitter Post
• https://t.me/CVEtracker/52845 · Telegram Post
• https://twitter.com/vuln_tracker/status/2052281427614667079 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2052194201421652286 · Twitter Post
• https://twitter.com/CVEnew/status/2051997184741249311 · Twitter Post