CVE-2026-83539
HighCVSS 7.4Summary
Cross-site scripting (XSS) vulnerability in the SmartLinkLabel and SmartLinkMultiLineLabel components of Apache Wicket. These components turn URLs found in text into hyperlinks and accept any URL scheme, including script-executing schemes such as javascript:. Escaping the model value does not help because the payload ends up in the href attribute rather than in element text.
Risk Assessment
An attacker can supply malicious text rendered by the application and cause script execution in the victim's browser when the link is clicked, within the application's origin and the user's session. Applications using these components are exposed, particularly if they have weakened or disabled Content-Security-Policy, and Wicket 8.x has no CSP support.
Recommendation
Upgrade Apache Wicket to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue. Keep the default nonce-based Content-Security-Policy enabled and avoid passing untrusted data to SmartLinkLabel and SmartLinkMultiLineLabel where possible.
Other vulnerabilities in Apache Wicket
See all- CVE-2026-95863High
Apache Wicket generates JavaScript that references rendered elements, placing markup ids and form input names inside single-quoted JavaScript string literals without proper escaping. A value containing a single quote or backslash can terminate the literal and inject script that runs in the application's origin when the page loads. The issue affects wicket-core and wicket-extensions in versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0.
- CVE-2026-87718Low
Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when deciding whether a request renders a page, so with a deeper chain, for example an application-provided delegating request mapper combined with CryptoMapper, the page is served without any CSP header even though CSP is enabled, and no error or warning is raised. The nonce-based protection Wicket applies to inline scripts and styles, together with any other CSP directives configured by the application, is thereby lost for those pages, exposing them to content injection the policy was meant to prevent. Applications on stock Wicket that do not wrap request handlers themselves are not affected. Versions before 10.10.0 and 9.24.0 handled nested delegates correctly.
- CVE-2026-84231High
A cross-site scripting (XSS) vulnerability in Apache Wicket arises from improper neutralization of input during web page generation. The ExternalLink component, when bound to a non-anchor element, concatenates the model URL into a JavaScript string literal in the onclick attribute without proper escaping, allowing script execution in the application's origin.
- CVE-2026-84177Medium
Apache Wicket has an incorrect behavior order: a file path is validated by PackageResourceGuard before the framework appends the style, variation and locale attributes. As a result, the file opened may differ from the file approved by the guard, allowing disclosure of HTML markup templates of components whose class names contain an underscore (e.g. Report_v2).
- CVE-2026-84172Medium
In Apache Wicket, PackageResourceGuard incorrectly allows component markup templates to be served as package resources when wicket-core is loaded by a class loader that cannot see the application's classes. In such a setup the check for a class file beside the template fails, and a request for the package resource URL returns the component's markup template with status 200. Disclosed content is developer-authored template material such as component structure, comments, inline script, and named endpoints.
- CVE-2026-84170High
A vulnerability in Apache Wicket affects AbstractFileUploadResource, the server side of the form-less upload offered by FileUploadToResourceField. The request size, single-part size and part-count limits are taken from request parameters (maxSize, fileMaxSize, fileCountMax) instead of application configuration, so a client can raise or omit them. The resource carries no authorization annotation, so by default requests need no authentication.
- CVE-2026-83594High
A vulnerability in Apache Wicket affects the FileUploadToResourceField component, whose Ajax callback reads the filesInfo request parameter without binding it to an actual upload. The UploadInfo#get() method allocates a byte array based on the client-supplied size, allowing a single request to exhaust the JVM heap, while negative values trigger a NegativeArraySizeException.
- CVE-2026-83559High
A vulnerability in Apache Wicket affects the JavaScriptUtils#escapeQuotes() method, which fails to escape the backslash character before quotes. A value containing a backslash immediately before a quote results in the quote being left unescaped, closing the JavaScript string literal and allowing JavaScript injection. The issue occurs when an application uses this method to place attacker-influenced data inside a JavaScript string literal, including via the AjaxEditableLabel component.
- CVE-2026-82956High
A cross-site scripting (XSS) vulnerability in Apache Wicket affects the AjaxNewWindowNotifyingBehavior, which stores the client-supplied window.name value in the page's serialized state. That value is later substituted without escaping into a single-quoted JavaScript string literal in the Ajax call precondition, allowing arbitrary script execution in the application's origin on every render of the page instance. Only applications that explicitly add this behavior to a component are affected.
- CVE-2026-111089High
Apache Wicket writes texts from resource bundles (labels, CSS class names) into generated JavaScript and markup without context-appropriate escaping. A text containing a quote can terminate the literal or attribute and be parsed as script or markup in the application's origin. Affected components include MultiFileUploadField, Form, UploadProgressBar, FilterForm and TrapFocusBehavior in versions 8.0.0–8.19.0, 9.0.0–9.24.0 and 10.0.0–10.11.0.
Original NVD description (English source)
Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.basic.SmartLinkLabel and org.apache.wicket.extensions.markup.html.basic.SmartLinkMultiLineLabel display a text value and turn any URL they find in it into a hyperlink. Both escape the model value and then hand the escaped text to org.apache.wicket.extensions.markup.html.basic.DefaultLinkParser, which searches it for anything of the form scheme://rest and wraps each match in an anchor whose href is the matched text, copied in as it is. The pattern accepts any scheme, and there is no list of permitted schemes anywhere on the path. A text value naming a scheme that executes script therefore becomes an anchor that executes it, in the application's origin and in the reader's own session, when the reader clicks the link. Rendering the page is not enough on its own; the link has to be activated. Escaping does not prevent this and is not the issue: the characters the payload needs are all valid in a URL and are ones that org.apache.wicket.util.string.Strings#escapeMarkup() leaves alone, and the value ends up in a URL rather than in element text, which is a context that escaping model data does not make safe. An application is affected where it renders text it received through either of these two components. That is what they are for: they exist to linkify email addresses and web URLs found in the data an application is displaying, so untrusted input is the purpose of the feature rather than a misuse of it, and no unusual configuration is involved. No other component uses this parser, and an application that uses neither SmartLinkLabel nor SmartLinkMultiLineLabel is not affected. On 9.x and 10.x the Content-Security-Policy Wicket sends by default admits script only from a source carrying a per-response nonce, and a URL whose scheme executes script cannot carry one, so that default policy stops the script from running. This is a property of the default policy and not of these components. An application that has weakened or disabled its Content-Security-Policy, for this or for any unrelated reason, is affected in full. Wicket 8.x has no Content-Security-Policy support at all and is affected as it stands. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS