Applications using wicket-core 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, or 10.0.0 through 10.10.0 are affected when another component consumes a multipart request before Wicket processes it. The fallback to HttpServletRequest#getParts() is the condition under which Wicket’s configured per-file and file-count limits are bypassed.
A remote uploader needs to submit a multipart upload request that reaches Wicket after its body has already been parsed by another component. They can then provide files larger than the configured per-file limit or more files than the configured file-count limit, subject to limits enforced by the component that parsed the request first.
No. Wicket enforces the configured form or upload-field limits when it parses the multipart request through Apache Commons FileUpload. The bypass occurs only when Commons FileUpload finds no items because another component has already consumed the request and Wicket falls back to request parts.
A multipart part without a Content-Type header is read fully into memory during parsing. Its allocation size is controlled by the request and is bounded only by the limits imposed by the component that parsed the request, rather than Wicket’s per-file or file-count limits.