CVE-2026-43646CWE-200

Apache Wicket: crafted URLs can bypass PackageResourceGuard

High · published May 6, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
49.2
In the wild
Unconfirmed
What it is

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket.

This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9.0.0 through 9.22.0, from 10.0.0 through 10.8.0.

Users are recommended to upgrade to version 10.9.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00622 · 49.2th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-05-06T08:31Z
EPSS history
Timeline
  • 06 MAY 08:31Z
    Apache Wicket: crafted URLs can bypass PackageResourceGuard
    cvelistv5