From announce-return-454-archive-asf-public=cust-asf.ponee.io@wicket.apache.org Sun Nov 1 21:23:38 2026 Return-Path: X-Original-To: archive-asf-public@cust-asf.ponee.io Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mxout2-ec2-sy.apache.org (mxout2-ec2-sy.apache.org [13.239.148.9]) by mx-eu-03.ponee.io (Postfix) with ESMTPS id 18D003E6DA for ; Sun, 1 Nov 2026 21:23:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apache.org; s=mail; t=1793568215; bh=3rVtQJd3Ir4++49VUETYbYBKuHq/hjoNdap1liQYdzs=; h=List-ID:list-help:list-unsubscribe:list-post:To:Message-ID: Content-Transfer-Encoding:Date:MIME-Version:Content-Type:From: Reply-To:Cc:From:List-Unsubscribe; b=IwgS+GMQd3IJbwP7d+Vn4CDHLzBTpwjkrnVm6i9iWhuthRTj16IppAE5aBkenpwpv +MHeuNywJWDLnRPa7KOtI+cXpmPJ7UycSd015l1ShnRnBvRRWx3lO0rC23J+F40Q8W pr31YtfkkwiAgtB2lzFIgbwlweWXiUq5eN0YuBTsH8GYgVq2Ef5+hQysBNf7EASjL+ yDJNNvvgtUaBZSrhJpVQUGPZ6T44IV/9O/N4mxO0Vt1qdb/fyfPSpjTaIB9udKiNjK zaZCMmJT/Lhd/rklN7YBC5Ths5jd6PaQLmPW8We9hSKToI8nIiCyzq858eLIPfca2A HjKQUMNkU+gCQ== Received: from mail.apache.org (mailgw-he-de.apache.org [116.203.246.181]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mxout2-ec2-sy.apache.org (ASF Mail Server at mxout2-ec2-sy.apache.org) with ESMTPS id 99E758D92F for ; Sun, 1 Nov 2026 21:23:34 +0000 (UTC) Received: (qmail 1181367 invoked by uid 998); 1 Nov 2026 21:23:31 -0000 Mailing-List: contact announce-help@wicket.apache.org; run by ezmlm List-ID: precedence: bulk list-help: list-unsubscribe: list-post: Delivered-To: mailing list announce@wicket.apache.org Received: (qmail 1181337 invoked by uid 116); 1 Nov 2026 21:23:30 -0000 Received: from ec2-13-52-191-92.us-west-1.compute.amazonaws.com (HELO mailrelay2-ec2-ca.apache.org) (13.52.191.92) by apache.org (qpsmtpd/0.94) with ESMTP; Sun, 01 Nov 2026 21:23:30 +0000 Authentication-Results: apache.org; auth=none Received: from security2-ec2-se.apache.org (ec2-51-21-223-204.eu-north-1.compute.amazonaws.com [51.21.223.204]) by mailrelay2-ec2-ca.apache.org (ASF Mail Server at mailrelay2-ec2-ca.apache.org) with ESMTPS id A7797871B5; Sun, 1 Nov 2026 21:23:29 +0000 (UTC) Received: by security2-ec2-se.apache.org (ASF Mail Server at security2-ec2-se.apache.org, from userid 1005) id 347C280AAC; Sun, 1 Nov 2026 21:23:28 +0000 (UTC) To: announce@apache.org, announce@wicket.apache.org Subject: CVE-2026-84177: Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore Message-ID: <34e74b19-5278-c6c4-75c9-ec08a24e0bce@apache.org> Content-Transfer-Encoding: quoted-printable Date: Sun, 01 Nov 2026 21:23:28 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 From: "Emond Papegaaij via announce" Reply-To: users@wicket.apache.org Cc: Emond Papegaaij Severity: moderate=20 CVSS 4.0: 6.3 (medium) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N= /SC:N/SI:N/SA:N Affected versions: - Apache Wicket (org.apache.wicket:wicket-core) 8.0.0 through 8.19.0 - Apache Wicket (org.apache.wicket:wicket-core) 9.0.0 through 9.24.0 - Apache Wicket (org.apache.wicket:wicket-core) 10.0.0 through 10.11.0 Description: Incorrect behavior order in Apache Wicket: a file path is validated before = the framework appends the attributes that complete it. org.apache.wicket.request.resource.PackageResource asks the configured = package resource guard about a path built from the scope class' package and= the file name in the request URL, and then hands that same path to the = resource stream locator together with a style, a variation and a locale. = Those three attributes are decoded from the name of the first query = parameter and never appear in the string the guard was given. org.apache.= wicket.core.util.resource.locator.ResourceNameIterator appends them to that= path, each preceded by an underscore, in the order variation, style, = locale, before the file extension, so the file that is opened is not the = file the guard approved. org.apache.wicket.markup.html.PackageResourceGuard decides whether an HTML = file is a component's markup template by looking for a class file of the = same name beside it, stripping one underscore-delimited suffix at a time as= it goes. HTML is on the default allow list, so that check is the only = thing separating a static HTML file, which may be served, from a markup = template, which may not. Asked about the name of a template, the guard = refuses it correctly. Asked about a shorter name for which no class exists,= it accepts, and a style supplied in the URL then completes that name into = the markup template of a component class, which is written to the response.= An application is affected if the simple name of any of its component = classes contains an underscore and no shorter part of that name is itself a= class, such as Report_v2 or Wizard_Step1; an application with no such = class name is not affected. No unusual deployment, packaging or = configuration is required, and running in deployment rather than = development mode does not prevent it. Java naming conventions discourage = underscores in class names and no module Wicket ships has one, so no = framework markup is exposed; what an application exposes this way is its = own. A component whose class name has no underscore is not reachable, and = neither is its localized or styled markup, because the guard finds the = class file under the base name and refuses the request. The attributes = cannot change the file extension and cannot leave the component's package, = so nothing beyond HTML files in that package is reachable. Access is = read-only, and what is disclosed is developer-authored template content: = component structure, developer comments, markup that is rendered only under= some conditions, inline script, and the endpoints a template names. No = user data, credential or session material is reachable this way. An = attacker has to name a class in the target package and the component itself= , and Wicket writes fully qualified class names into the URL of every = package resource it renders. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 = through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or = older, which are no longer supported, should upgrade to a supported version= . Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, = which fix the issue. Credit: Emond Papegaaij (finder) References: https://wicket.apache.org/ https://www.cve.org/CVERecord?id=3DCVE-2026-84177 --------------------------------------------------------------------- To unsubscribe, e-mail: announce-unsubscribe@wicket.apache.org For additional commands, e-mail: announce-help@wicket.apache.org