CVE-2026-43975
Last modified
CVE-2026-43975 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the clientFileName before constructing file paths, allowing an unauthenticated attacker to write arbitrary files outside the intended upload directory or read files from arbitrary locations on the server. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9.0.0 through 9.22.0, from 10.0.0 through 10.8.0. Users are recommended to upgrade to version 10.9.0, which fixes the issue.. EPSS estimates a 0.73% chance of exploitation in the next 30 days.
Description
FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the clientFileName before constructing file paths, allowing an unauthenticated attacker to write arbitrary files outside the intended upload directory or read files from arbitrary locations on the server. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9.0.0 through 9.22.0, from 10.0.0 through 10.8.0. Users are recommended to upgrade to version 10.9.0, which fixes the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Wicket | >= 8.0.0, <= 8.17.0 |
| Apache | Wicket | >= 9.0.0, <= 9.22.0 |
| Apache | Wicket | >= 10.0.0, < 10.9.0 |
References
- https://github.com/apache/wicket/pull/1432Issue Tracking, Patch
- http://www.openwall.com/lists/oss-security/2026/05/06/4Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-43975?
How severe is CVE-2026-43975?
How do I fix CVE-2026-43975?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-43968Improper Neutralization of CRLF Sequences ('CRLF Injection')…4
- CVE-2026-43969Improper Neutralization of CRLF Sequences ('CRLF Injection')…3.2
- CVE-2026-43970Improper Handling of Highly Compressed Data (Data Amplificat…8.2
- CVE-2026-43972Origin Validation Error vulnerability in ninenines gun (gun_…6.3
- CVE-2026-43973Uncontrolled Resource Consumption vulnerability in ninenines…8.7
- CVE-2026-43974Unexpected Status Code or Return Value vulnerability in nine…8.7
- CVE-2026-43977wger is a free, open-source workout and fitness manager. In …7.5
- CVE-2026-43978wger is a free, open-source workout and fitness manager. In …8.1
- CVE-2026-43979Local Deep Research is an AI-powered research assistant for …5
- CVE-2026-4398Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-43981Algernon is a small self-contained pure-Go web server. Prior…8.2
- CVE-2026-43982Algernon is a small self-contained pure-Go web server. Prior…8.7
Are you affected by CVE-2026-43975?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST