CVE-2026-43975

published 2026-05-06

CVE-2026-43975: FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the clientFileName before constructing file paths…

Priority P3 46 medium 6.5 CVSS 3.1

AV N AC L PR N UI N S U C L I L A N

FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the clientFileName
before constructing file paths, allowing an unauthenticated attacker to
write arbitrary files outside the intended upload directory or read
files from arbitrary locations on the server.

This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9.0.0 through 9.22.0, from 10.0.0 through 10.8.0.

Users are recommended to upgrade to version 10.9.0, which fixes the issue.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
apache	wicket	>= 10.0.0 < 10.9.0	10.9.0
apache	wicket	8.0.0 – 8.17.0	—
apache	wicket	9.0.0 – 9.22.0	—
apache_software_foundation	apache_wicket	10.0.0 – 10.8.0	—
apache_software_foundation	apache_wicket	8.0.0 – 8.17	—
apache_software_foundation	apache_wicket	9.0.0 – 9.22.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22