CVE-2026-75802: Apache Wicket XSS Vulnerability

CVE-2026-75802 Overview

CVE-2026-75802 is a stored cross-site scripting (XSS) vulnerability in Apache Wicket's AjaxEditableChoiceLabel, AjaxEditableLabel, and AjaxEditableMultiLineLabel components from the wicket-extensions module. When AjaxEditableChoiceLabel is constructed with a non-null IChoiceRenderer, the display value returned by the renderer is written into the label's markup without the HTML escaping Wicket applies by default. The same three components also write the value returned by defaultNullLabel() into markup without escaping when the model is empty. An attacker who can influence the choice, model data, or overridden null label can inject HTML or JavaScript that executes in any user's browser rendering the affected page. The vulnerability is tracked as [CWE-79].

Critical Impact
Attacker-controlled input rendered by affected Wicket label components executes as HTML or script in victims' browsers, enabling session theft, account takeover, and UI redress against any user viewing the compromised page.

Affected Products

Apache Wicket 8.0.0 through 8.18.0
Apache Wicket 9.0.0 through 9.23.0
Apache Wicket 10.0.0 through 10.10.0

Discovery Timeline

2026-08-31 - CVE-2026-75802 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-75802

Vulnerability Analysis

Wicket components normally escape model values before writing them into HTML markup. The affected AjaxEditable* components in wicket-extensions bypass that protection in two distinct code paths. First, AjaxEditableChoiceLabel constructed with a non-null IChoiceRenderer writes the renderer's display value directly into the label's markup. Second, all three components write the value returned by the protected defaultNullLabel() method into markup unescaped when the underlying model is empty.

The dropdown editor for the same components does escape the value when rendering it as an option, so the exposure is limited to label rendering. Applications that override defaultNullLabel() to return attacker-influenced data are vulnerable through that path even without a custom IChoiceRenderer.

Root Cause

The unescaped write occurs inside the label rendering logic these components delegate to, rather than in the components themselves. The escapeModelStrings configuration flag is read by the inner label but is never propagated from the parent AjaxEditable* component. As a result, developers cannot mitigate the issue by setting escapeModelStrings(true) on the component. The default defaultNullLabel() implementation returns a static constant, so only overrides that surface untrusted data create the null-label exposure. The choice-renderer exposure has existed since Wicket 6.22.0, and the null-label exposure since 1.4.0.

Attack Vector

An attacker submits data that reaches an IChoiceRenderer display value, a bound model value, or an overridden defaultNullLabel() return value on an affected component. When any user, including administrators, loads the page containing the label, the injected HTML or script executes in that user's browser under the application's origin. Exploitation requires the attacker to have some ability to influence rendered data, typically via a user-facing form field, API, or persisted record consumed by the page.

See the Apache Wicket security advisory and the Openwall OSS Security discussion for additional technical detail.

Detection Methods for CVE-2026-75802

Indicators of Compromise

Stored records or form submissions containing HTML tags such as <script>, <img onerror=...>, or <svg onload=...> in fields later rendered by AjaxEditableChoiceLabel, AjaxEditableLabel, or AjaxEditableMultiLineLabel.
Unexpected outbound requests from user browsers to attacker-controlled hosts shortly after loading pages that use affected Wicket components.
Session or authentication cookies appearing in web server access logs of unrelated third-party domains.

Detection Strategies

Perform a source-code audit for constructions of AjaxEditableChoiceLabel with a non-null IChoiceRenderer and for any subclass overriding defaultNullLabel().
Inspect Wicket dependency versions in build manifests such as pom.xml and build.gradle for versions in the affected ranges.
Deploy a web application firewall (WAF) rule that flags reflected or stored payloads containing script tags in requests targeting Wicket endpoints.

Monitoring Recommendations

Monitor HTTP response bodies from Wicket-backed URLs for unsanitized markup written into label elements.
Alert on Content Security Policy (CSP) violation reports referencing inline script execution on pages that render editable labels.
Correlate authentication anomalies with recent page views of pages containing affected components to identify potential session hijacking.

How to Mitigate CVE-2026-75802

Immediate Actions Required

Upgrade Apache Wicket to version 8.19.0, 9.24.0, or 10.11.0 depending on the branch in use.
Identify and audit every application usage of AjaxEditableChoiceLabel, AjaxEditableLabel, and AjaxEditableMultiLineLabel, particularly those with a custom IChoiceRenderer or an overridden defaultNullLabel().
Invalidate active user sessions if analysis indicates any user rendered attacker-controlled data through an affected component.

Patch Information

The Apache Wicket project has released fixed versions 8.19.0, 9.24.0, and 10.11.0. The fixes ensure that both the choice renderer's display value and the defaultNullLabel() return value are HTML-escaped consistently with other Wicket model values. Refer to the Apache Wicket announcement for release details.

Workarounds

Replace affected components with escaped alternatives such as Label bound to a pre-sanitized model, or wrap the display value in an escaping helper before returning it from the IChoiceRenderer.
Ensure overrides of defaultNullLabel() return only static, developer-controlled strings until the upgrade is applied.
Enforce a strict Content Security Policy that disallows inline scripts to reduce impact if injected markup executes.

bash

# Maven dependency update example
mvn versions:set-property -Dproperty=wicket.version -DnewVersion=10.11.0
mvn -U clean verify