{"id":"CVE-2026-84172","kind":"vulnerability","aliases":["CVE-2026-84172"],"related":[],"title":"Apache Wicket: template files served to clients in unusual class loader setups","description":"Files accessible to external parties in Apache Wicket.\n\norg.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that separates a static HTML file, which may be served, from a component's markup template, which may not, is a check for a class file of the same name beside it. That check calls getResource() on the class loader that loaded wicket-core. The resource itself is reached through different class loaders: the scope class is resolved through the application's IClassResolver, which uses the thread context class loader, and org.apache.wicket.core.util.resource.ClassPathResourceFinder#find() then tries the scope class' own loader, the context class loader, and the wicket-core loader last.\n\nWhere wicket-core is loaded by a class loader that cannot see the application's classes, the check finds no class file, concludes the file is not a component markup template, and serves it. A request for the package resource URL of a component class then returns that component's markup template with status 200. What is disclosed is developer-authored template content: component structure, developer comments, markup that is rendered only under some conditions, inline script, and the endpoints a template names. Access is read-only, and no user data, credential or session material is reachable this way.\n\nSuch a deployment is rare. The ordinary packaging, a web archive with wicket-core in WEB-INF/lib, puts the framework and the application in one class loader, so the check finds the class file and the template is refused; those deployments are not affected. The exposure is confined to deployments that give wicket-core a class loader which cannot see the application's component classes: wicket-core placed in a servlet container's shared library directory, in an enterprise archive library directory with the application in the web archive, as an application server global module, or as an OSGi bundle, where wicket-core's bundle cannot resolve a class held by an application bundle. Markup shipped by Wicket's own modules, and by any other code sharing a class loader with wicket-core, remains protected. An attacker has to name a component class, and Wicket writes fully qualified class names into the URL of every package resource it renders.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","summary":"When wicket-core runs in a class loader that cannot see the application's component classes, Wicket's package resource guard fails to recognise component markup templates and serves them as static files. An attacker who names a component class in the package resource URL can read that template, exposing developer comments, markup, inline script and endpoints, but not user data or credentials.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-wicket","java","osgi","package","self-hosted","servlet-container"],"not_affected_if":["standard-war-layout","unaffected-version","wicket-in-webinf-lib"],"how_to_check":"- Check the Apache Wicket version in the project's dependencies, such as `wicket-core` in `pom.xml` or `build.gradle`; affected versions are 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0.\n- Check whether `wicket-core` is placed in a servlet container shared library directory, an EAR library directory with the application in the WAR, an application server global module, or an OSGi bundle; the exposure applies only to these layouts.\n- Standard WAR deployments with `wicket-core` in `WEB-INF/lib` are not affected according to the sources.","fix":"- Apache Wicket `8.20.0`\n- Apache Wicket `9.25.0`\n- Apache Wicket `10.12.0`\n- Apache Wicket 7.x and older are unsupported; upgrade to a supported version.","status":"open","published_at":"2026-11-01T23:17:30+00:00","first_seen_at":"2026-11-01T23:22:40+00:00","triaged_at":"2026-11-01T23:23:33+00:00","updated_at":"2026-11-01T23:23:33+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-01T23:23:33Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Wicket `8.20.0`\n- Apache Wicket `9.25.0`\n- Apache Wicket `10.12.0`\n- Apache Wicket 7.x and older are unsupported; upgrade to a supported version.","reach":"internet","title":"Apache Wicket: template files served to clients in unusual class loader setups","impact":"low","summary":"When wicket-core runs in a class loader that cannot see the application's component classes, Wicket's package resource guard fails to recognise component markup templates and serves them as static files. An attacker who names a component class in the package resource URL can read that template, exposing developer comments, markup, inline script and endpoints, but not user data or credentials.","audience":"developers","category":"package","nicknames":[],"who_cares":["apache-wicket","java","self-hosted","servlet-container","osgi"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Component markup templates are readable by remote clients, read-only.","analyst_note":"","how_to_check":"- Check the Apache Wicket version in the project's dependencies, such as `wicket-core` in `pom.xml` or `build.gradle`; affected versions are 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0.\n- Check whether `wicket-core` is placed in a servlet container shared library directory, an EAR library directory with the application in the WAR, an application server global module, or an OSGi bundle; the exposure applies only to these layouts.\n- Standard WAR deployments with `wicket-core` in `WEB-INF/lib` are not affected according to the sources.","plain_action":"","needs_analyst":false,"not_affected_if":["standard-war-layout","wicket-in-webinf-lib","unaffected-version"],"who_is_affected":"Only applications where wicket-core is loaded by a class loader that cannot see the application's component classes, such as a shared servlet container library, an EAR library with the application in the WAR, an application server global module, or an OSGi bundle. Standard WAR deployments with wicket-core in WEB-INF/lib are not affected. An attacker must name a component class in the package resource URL, which Wicket writes into rendered pages.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000886,"input_tokens":4830,"output_tokens":805,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-84172':15A,18A '/lib':345C '10.0.0':506C '10.11.0':508C '10.12.0':538C '200':279C '7':513C '8.0.0':498C '8.19.0':500C '8.20.0':535C '9.0.0':502C '9.24.0':504C '9.25.0':536C 'access':96C,309C 'affect':372C,494C 'allow':126C 'apach':1A,20B,101C,495C,511C 'apache-wicket':19B 'applic':44B,193C,238C,351C,391C,415C,422C,444C 'archiv':336C,410C,419C 'attack':66B,469C 'author':286C 'besid':162C 'bundl':430C,436C,445C 'call':166C 'cannot':41B,235C,388C,437C 'check':153C,165C,242C,358C 'class':10A,38B,47B,71B,156C,170C,184C,188C,201C,210C,215C,232C,240C,245C,269C,354C,361C,385C,394C,440C,460C,475C,481C 'classpath':110C 'client':7A,116C 'code':457C 'comment':83B,292C 'compon':46B,56B,70B,144C,253C,268C,273C,289C,393C,474C 'conclud':247C 'condit':300C 'confin':376C 'contain':30B,402C 'content':288C 'context':200C,214C 'core':34B,176C,221C,227C,340C,383C,397C,434C,465C 'credenti':94B,318C 'cve':13A,16A 'data':92B,317C 'decid':104C 'default':125C 'deploy':328C,369C,378C 'develop':82B,285C,291C 'developer-author':284C 'differ':183C 'directori':406C,412C 'disclos':282C 'endpoint':88B,305C 'enterpris':409C 'everi':487C 'expos':81B 'exposur':374C 'extern':98C 'fail':53B 'file':4A,64B,95C,107C,137C,157C,246C,249C,362C 'find':205C,243C,359C 'fix':540C 'framework':348C 'fulli':479C 'getresourc':167C 'give':380C 'global':424C 'guard':52B 'held':441C 'host':27B 'html':121C,136C 'iclassresolv':195C 'inf':344C 'inlin':85B,301C 'issu':493C,542C 'java':22B 'last':223C 'librari':405C,411C 'list':127C 'load':173C,229C 'loader':11A,39B,171C,185C,202C,212C,216C,222C,233C,355C,386C,461C 'longer':520C 'markup':57B,84B,146C,254C,275C,293C,446C 'materi':321C 'may':111C,139C,149C 'modul':425C,452C 'name':68B,161C,308C,472C,482C 'older':516C 'one':353C 'ordinari':332C 'org.apache.wicket.core.util.resource.classpathresourcefinder':204C 'org.apache.wicket.markup.html.packageresourceguard':103C 'osgi':23B,429C 'packag':24B,50B,74B,119C,263C,333C,488C 'parti':99C 'place':398C 'protect':467C 'put':346C 'qualifi':480C 'rare':330C 'reach':181C 'reachabl':323C 'read':78B,312C 'read-on':311C 'recognis':55B 'recommend':530C 'refus':367C 'remain':466C 'render':296C,491C 'request':260C 'resolv':190C,438C 'resourc':51B,75B,120C,178C,264C,489C 'return':271C 'run':35B 'scope':187C,209C 'script':86B,302C 'see':42B,236C,389C 'self':26B 'self-host':25B 'separ':133C 'serv':5A,60B,141C,257C 'server':423C 'servlet':29B,401C 'servlet-contain':28B 'session':320C 'setup':12A 'share':404C,458C 'ship':447C 'static':63B,135C 'status':278C 'stream':113C 'structur':290C 'support':521C,526C 'templat':3A,58B,80B,147C,255C,276C,287C,307C,365C 'thing':131C 'thread':199C 'tri':207C 'unusu':9A 'upgrad':523C,532C 'url':76B,265C,485C 'use':197C 'user':91B,316C,509C,528C 'version':527C,534C 'way':325C 'web':335C,343C,418C 'web-inf':342C 'whether':105C 'wicket':2A,21B,33B,48B,102C,175C,220C,226C,339C,382C,396C,433C,449C,464C,477C,496C,512C 'wicket-cor':32B,174C,219C,225C,338C,381C,395C,432C,463C 'write':478C 'x':514C","nicknames":[],"mitigations":[],"who_affected":"Only applications where wicket-core is loaded by a class loader that cannot see the application's component classes, such as a shared servlet container library, an EAR library with the application in the WAR, an application server global module, or an OSGi bundle. Standard WAR deployments with wicket-core in WEB-INF/lib are not affected. An attacker must name a component class in the package resource URL, which Wicket writes into rendered pages.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-11-01T23:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84172","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84172","severity":null,"published_at":"2026-11-01T23:17:30+00:00","modified_at":"2026-11-01T23:17:30+00:00","first_seen_at":"2026-11-01T23:22:40+00:00","fetched_at":"2026-11-01T23:22:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}