Medium severity · published May 6, 2026
CVE-2026-43975
Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the clientFileName
before constructing file paths, allowing an unauthenticated attacker to
write arbitrary files outside the intended upload directory or read
files from arbitrary locations on the server.
This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9.0.0 through 9.22.0, from 10.0.0 through 10.8.0.
Users are recommended to upgrade to version 10.9.0, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AW
Apache Wicket · Apache Software Foundation
10.0.0 through 10.8.0; 9.0.0 through 9.22.0; 8.0.0 through 8.17 · source: vendor
WI
Wicket · Apache
8.0.0 through 8.17.0; 9.0.0 through 9.22.0; 10.0.0 before 10.9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-43975
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-43975
Issue Tracking
https://github.com/apache/wicket/pull/1432
Vendor Advisory
https://lists.apache.org/thread/xp2jrdk6ppv1zcmxb4w1mk2lg1dw3hbr
Mailing List
http://www.openwall.com/lists/oss-security/2026/05/06/4
More from Apache Wicket
9.1
CVE-2026-40010
Apache Wicket: possible session fixation using AuthenticatedWebSession
7.5
CVE-2026-71257
Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed
7.5
CVE-2026-43646
Apache Wicket: crafted URLs can bypass PackageResourceGuard
6.5
CVE-2026-66391
Apache Wicket: leaked and missing CSP headers
6.1
CVE-2026-76986
Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue