CVE-2026-70449 Overview
CVE-2026-70449 is a path traversal vulnerability in Apache Wicket that allows unauthenticated remote attackers to read files from the web application, including files under WEB-INF that the servlet container would not otherwise serve. The flaw stems from improper validation of the locale, style, and variation attributes decoded from package resource URLs. Wicket splices these attacker-controlled values into the resource lookup path without checking for path separators, enabling directory traversal on servlet containers that normalize .. in ServletContext.getResource().
The issue affects Apache Wicket versions 8.18.0 and earlier, 9.23.0 and earlier, and 10.10.0 and earlier. Fixed versions are 8.19.0, 9.24.0, and 10.11.0.
Critical Impact
Unauthenticated attackers can read arbitrary files matching allowed extensions from within the web application, and use the pre-guard lookup as an existence oracle for any path.
Affected Products
- Apache Wicket 8.18.0 and earlier
- Apache Wicket 9.23.0 and earlier
- Apache Wicket 10.10.0 and earlier
Discovery Timeline
- 2026-08-31 - CVE-2026-70449 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-70449
Vulnerability Analysis
Apache Wicket serves static assets through its package resource mechanism. When a package resource URL is decoded, Wicket extracts the locale, style, and variation attributes and appends them to the resource lookup path. These attributes are attacker-controlled but never validated for path separator characters such as / or ...
The framework relies on two intended controls to restrict resource access. The IPackageResourceGuard rejects paths containing .., but this check runs against the resource name before the attacker-controlled attributes are appended. The WebApplicationPath component rejects only paths that begin literally with WEB-INF/. Neither control inspects the portion of the path derived from URL attributes.
On servlet containers that normalize .. sequences inside ServletContext.getResource(), a crafted request escapes the intended package directory. The vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.
Root Cause
The root cause is the order of operations in Wicket's resource resolution pipeline. Path separator validation runs before untrusted URL attributes are concatenated into the final lookup path. This leaves the locale, style, and variation values as an unchecked injection point for traversal sequences.
Attack Vector
An unauthenticated remote attacker crafts a package resource URL that encodes .. sequences within the locale, style, or variation attributes. The servlet container normalizes the resulting path and returns files outside the intended package directory. Readable files are limited to extensions permitted by the configured IPackageResourceGuard. The default SecurePackageResourceGuard permits js, css, png, jpg, jpeg, gif, ico, cur, map, html, txt, swf, bmp, svg, avif, eot, ttf, woff, and woff2, which excludes typical configuration formats. Applications using the blocklist-based PackageResourceGuard, or that have extended the allowlist, may disclose configuration files such as web.xml. Independent of the extension filter, the lookup performed before the guard runs functions as an existence oracle for arbitrary paths.
Refer to the Apache Wicket security advisory and the Openwall OSS-Security disclosure for additional technical detail.
Detection Methods for CVE-2026-70449
Indicators of Compromise
- HTTP requests to Wicket resource URLs containing encoded .. sequences within locale, style, or variation query parameters or URL segments.
- Access log entries returning static resources whose paths deviate from application package structure.
- Anomalous requests for filenames matching WEB-INF resources such as web.xml.html or extension-manipulated configuration files.
Detection Strategies
- Inspect web server and application access logs for URL-encoded traversal patterns (%2e%2e, ..%2f) in Wicket resource requests.
- Compare requested resource paths against the expected package resource inventory and alert on mismatches.
- Deploy WAF signatures that flag path traversal sequences appearing in the query string components tied to Wicket resource handling.
Monitoring Recommendations
- Enable verbose logging on Wicket resource resolution and forward the logs to a centralized SIEM for correlation.
- Monitor for repeated 200 responses to unusual resource URLs, which may indicate an attacker enumerating files via the existence oracle.
- Track outbound file reads from the deployed WAR or exploded application directory that fall outside expected asset paths.
How to Mitigate CVE-2026-70449
Immediate Actions Required
- Upgrade Apache Wicket to version 8.19.0, 9.24.0, or 10.11.0 depending on the branch in use.
- Users of Apache Wicket 7.x or earlier, which are no longer supported, should migrate to a supported and patched release.
- Audit deployed applications for custom IPackageResourceGuard implementations that permit configuration file extensions and revert to the default SecurePackageResourceGuard where feasible.
Patch Information
The Apache Wicket project has released fixed versions 8.19.0, 9.24.0, and 10.11.0. The patches enforce validation of path separator characters in the locale, style, and variation attributes before they are appended to the resource lookup path. Full details are available in the Apache Wicket announcement thread.
Workarounds
- If immediate upgrade is not possible, restrict allowed resource extensions to the minimum required set using SecurePackageResourceGuard.
- Deploy a reverse proxy or WAF rule that rejects Wicket resource URLs containing .., %2e%2e, or encoded path separators in locale, style, or variation segments.
- Configure the servlet container to reject requests where normalized paths escape the application context root.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
