CVE-2026-70449

Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the servlet container would not otherwise serve. The locale, style and variation attributes decoded from a package resource URL are spliced into the resource lookup path without being checked for path separators. The IPackageResourceGuard — whose rejection of .. is one of the two intended controls — is applied to the resource name before those attributes are appended, and WebApplicationPath rejects only paths literally beginning with WEB-INF/. Neither control ever inspects the attacker-controlled portion of the path. On servlet containers that normalize .. in ServletContext.getResource(), a crafted request therefore escapes the intended package directory. The set of readable files is limited to the file extensions permitted by the configured IPackageResourceGuard. The default SecurePackageResourceGuard permits only js, css, png, jpg, jpeg, gif, ico, cur, map, html, txt, swf, bmp, svg, avif, eot, ttf, woff and woff2, which excludes configuration formats. Applications that have added patterns to the guard, or replaced it with the blocklist-based PackageResourceGuard, can additionally disclose configuration files such as web.xml. Independently of the extension, the lookup performed before the guard runs acts as an existence oracle for arbitrary paths. This issue affects Apache Wicket 8.18.0 and before, 9.23.0 and before and 10.10.0 and before. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version.

• CWE-22

• https://lists.apache.org/thread/f4pb2q2ksdsfv1o315slp36dx66bf5vgVendor Advisory, Mailing List
• https://www.openwall.com/lists/oss-security/2026/08/30/3Mailing List, Third Party Advisory

Published

Aug 31, 2026

Last Modified

Sep 1, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-70443Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlie…4.3
• CVE-2026-70444A missing permission check in Jenkins Violation Comments to …4.3
• CVE-2026-70445Missing permission checks in Jenkins Sauce OnDemand Plugin 2…4.3
• CVE-2026-70446Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 …4.3
• CVE-2026-70447Missing permission checks in Jenkins AWS CodeBuild Plugin 0.…4.3
• CVE-2026-70448Jenkins Ivy Report Plugin 1.2 and earlier does not configure…7.1
• CVE-2026-7045A vulnerability was determined in baomidou dynamic-datasourc…6.3
• CVE-2026-70452rsync 3.1.0 before 3.5.0 contains an access control bypass v…7.4
• CVE-2026-70453rsync before 3.5.0 contains an algorithmic complexity vulner…7.5
• CVE-2026-70454rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl throu…8
• CVE-2026-70455rsync 3.4.2 before 3.5.0 contains a denial of service vulner…7.5
• CVE-2026-70456rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vul…8.2