GHSA-jvv4-8wxx-m5r6: Apache Wicket: crafted URLs can bypass PackageResourceGuard

Q: Which deployments should be prioritized for remediation?

Apache Wicket deployments running versions 8.0.0 through 8.17.0, 9.0.0 through 9.22.0, or 10.0.0 through 10.8.0 are affected. The issue is rated high severity with a 7.5 CVSS score.

Q: Does exploitation require an authenticated user or user interaction?

No. The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the recommended remediation?

Upgrade Apache Wicket to version 10.9.0, which fixes the issue. If an upgrade cannot be performed immediately, the provided data does not identify a workaround or configuration-based mitigation.

Q: How can I determine whether an application is affected?

Identify the Apache Wicket version used by the application and compare it with the affected ranges. Any version in the listed 8.x, 9.x, or 10.x ranges is affected.

Published May 6, 2026

Updated

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket.

This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9.0.0 through 9.22.0, from 10.0.0 through 10.8.0.

Users are recommended to upgrade to version 10.9.0, which fixes the issue.

Affected Software

1 affected component

Apache wicket>=8.0.0<=8.17.0, >=9.0.0<=9.22.0, >=10.0.0<=10.8.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Wicket to a version that resolves this vulnerability.
Fixed in 10.9.0

Event History

May 6, 2026

CVE Published

via OSV·08:31 AM

Data Sourced

via OSV·08:31 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments should be prioritized for remediation?

Apache Wicket deployments running versions 8.0.0 through 8.17.0, 9.0.0 through 9.22.0, or 10.0.0 through 10.8.0 are affected. The issue is rated high severity with a 7.5 CVSS score.

Does exploitation require an authenticated user or user interaction?

No. The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the recommended remediation?

Upgrade Apache Wicket to version 10.9.0, which fixes the issue. If an upgrade cannot be performed immediately, the provided data does not identify a workaround or configuration-based mitigation.

How can I determine whether an application is affected?

Identify the Apache Wicket version used by the application and compare it with the affected ranges. Any version in the listed 8.x, 9.x, or 10.x ranges is affected.

GHSA-jvv4-8wxx-m5r6: Apache Wicket: crafted URLs can bypass PackageResourceGuard

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments should be prioritized for remediation?

Does exploitation require an authenticated user or user interaction?

What is the recommended remediation?

How can I determine whether an application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for remediation?

Does exploitation require an authenticated user or user interaction?

What is the recommended remediation?

How can I determine whether an application is affected?