{"id":"CVE-2026-84177","kind":"vulnerability","aliases":["CVE-2026-84177"],"related":[],"title":"Apache Wicket: file path check misses style and locale suffixes, leaking HTML templates","description":"Incorrect behavior order in Apache Wicket: a file path is validated before the framework appends the attributes that complete it.\n\norg.apache.wicket.request.resource.PackageResource asks the configured package resource guard about a path built from the scope class' package and the file name in the request URL, and then hands that same path to the resource stream locator together with a style, a variation and a locale. Those three attributes are decoded from the name of the first query parameter and never appear in the string the guard was given. org.apache.wicket.core.util.resource.locator.ResourceNameIterator appends them to that path, each preceded by an underscore, in the order variation, style, locale, before the file extension, so the file that is opened is not the file the guard approved.\n\norg.apache.wicket.markup.html.PackageResourceGuard decides whether an HTML file is a component's markup template by looking for a class file of the same name beside it, stripping one underscore-delimited suffix at a time as it goes. HTML is on the default allow list, so that check is the only thing separating a static HTML file, which may be served, from a markup template, which may not. Asked about the name of a template, the guard refuses it correctly. Asked about a shorter name for which no class exists, it accepts, and a style supplied in the URL then completes that name into the markup template of a component class, which is written to the response.\n\nAn application is affected if the simple name of any of its component classes contains an underscore and no shorter part of that name is itself a class, such as Report_v2 or Wizard_Step1; an application with no such class name is not affected. No unusual deployment, packaging or configuration is required, and running in deployment rather than development mode does not prevent it. Java naming conventions discourage underscores in class names and no module Wicket ships has one, so no framework markup is exposed; what an application exposes this way is its own. A component whose class name has no underscore is not reachable, and neither is its localized or styled markup, because the guard finds the class file under the base name and refuses the request. The attributes cannot change the file extension and cannot leave the component's package, so nothing beyond HTML files in that package is reachable. Access is read-only, and what is disclosed is developer-authored template content: component structure, developer comments, markup that is rendered only under some conditions, inline script, and the endpoints a template names. No user data, credential or session material is reachable this way. An attacker has to name a class in the target package and the component itself, and Wicket writes fully qualified class names into the URL of every package resource it renders.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","summary":"Apache Wicket checks a resource path before it appends the style, variation and locale taken from the request, so a crafted request can read a component's HTML markup template. An attacker can read developer-authored template content such as comments, structure and endpoints, but not user data, credentials or session material.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-wicket","java","package","web-apps"],"not_affected_if":["no-underscore-in-component-class-names","wicket-patched-version"],"how_to_check":"- Check the Wicket version in the build file (for example `mvn dependency:tree | grep wicket-core` or the Gradle dependency list).\n- Look for component class simple names containing an underscore, such as `Report_v2` or `Wizard_Step1`, where no shorter part of the name is also a class.","fix":"- Apache Wicket 8.x: upgrade to `8.20.0`\n- Apache Wicket 9.x: upgrade to `9.25.0`\n- Apache Wicket 10.x: upgrade to `10.12.0`\n- Apache Wicket 7.x and older: no longer supported; upgrade to a supported version","status":"open","published_at":"2026-11-01T23:17:30+00:00","first_seen_at":"2026-11-01T23:22:40+00:00","triaged_at":"2026-11-01T23:23:32+00:00","updated_at":"2026-11-01T23:23:32+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-01T23:23:32Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Wicket 8.x: upgrade to `8.20.0`\n- Apache Wicket 9.x: upgrade to `9.25.0`\n- Apache Wicket 10.x: upgrade to `10.12.0`\n- Apache Wicket 7.x and older: no longer supported; upgrade to a supported version","reach":"internet","title":"Apache Wicket: file path check misses style and locale suffixes, leaking HTML templates","impact":"low","summary":"Apache Wicket checks a resource path before it appends the style, variation and locale taken from the request, so a crafted request can read a component's HTML markup template. An attacker can read developer-authored template content such as comments, structure and endpoints, but not user data, credentials or session material.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-wicket","java","web-apps"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"HTML template content of a component is readable over the web","analyst_note":"","how_to_check":"- Check the Wicket version in the build file (for example `mvn dependency:tree | grep wicket-core` or the Gradle dependency list).\n- Look for component class simple names containing an underscore, such as `Report_v2` or `Wizard_Step1`, where no shorter part of the name is also a class.","plain_action":"","needs_analyst":false,"not_affected_if":["no-underscore-in-component-class-names","wicket-patched-version"],"who_is_affected":"Applications built on Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, or 10.0.0 through 10.11.0 are exposed only if at least one component class simple name contains an underscore and no shorter part of that name is itself a class. Applications with no such class name are not affected. Teams running Wicket 7.x or older should move to a supported version.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000838,"input_tokens":4959,"output_tokens":684,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-84177':16A,19A '10.0.0':561C '10.11.0':563C '10.12.0':593C '7':568C '8.0.0':553C '8.19.0':555C '8.20.0':590C '9.0.0':557C '9.24.0':559C '9.25.0':591C 'accept':291C 'access':470C 'affect':320C,361C,549C 'allow':243C 'apach':1A,21B,28B,85C,550C,566C 'apache-wicket':20B 'app':27B 'appear':160C 'append':36B,95C,169C 'applic':318C,353C,405C 'approv':201C 'ask':102C,268C,280C 'attack':59B,517C 'attribut':97C,147C,447C 'author':64B,482C 'base':440C 'behavior':82C 'besid':224C 'beyond':462C 'built':111C 'cannot':448C,454C 'chang':449C 'check':5A,30B,247C 'class':115C,218C,288C,310C,330C,344C,357C,388C,415C,436C,522C,536C 'comment':69B,488C 'complet':99C,300C 'compon':53B,210C,309C,329C,413C,457C,485C,529C 'condit':496C 'configur':104C,367C 'contain':331C 'content':66B,484C 'convent':384C 'correct':279C 'craft':48B 'credenti':77B,508C 'cve':14A,17A 'data':76B,507C 'decid':203C 'decod':149C 'default':242C 'delimit':230C 'deploy':364C,373C 'develop':63B,376C,481C,487C 'developer-author':62B,480C 'disclos':478C 'discourag':385C 'endpoint':72B,501C 'everi':542C 'exist':289C 'expos':402C,406C 'extens':188C,452C 'file':3A,88C,119C,187C,191C,198C,207C,219C,256C,437C,451C,464C 'find':434C 'first':155C 'fix':595C 'framework':94C,399C 'fulli':534C 'given':167C 'goe':237C 'guard':107C,165C,200C,276C,433C 'hand':127C 'html':12A,55B,206C,238C,255C,463C 'incorrect':81C 'inlin':497C 'issu':548C,597C 'java':23B,382C 'leak':11A 'leav':455C 'list':244C 'local':9A,41B,144C,184C,427C 'locat':135C 'longer':575C 'look':215C 'markup':56B,212C,263C,305C,400C,430C,489C 'materi':80B,511C 'may':258C,266C 'miss':6A 'mode':377C 'modul':392C 'name':120C,152C,223C,271C,284C,302C,324C,340C,358C,383C,389C,416C,441C,504C,520C,537C 'neither':424C 'never':159C 'noth':461C 'older':571C 'one':227C,396C 'open':194C 'order':83C,181C 'org.apache.wicket.core.util.resource.locator.resourcenameiterator':168C 'org.apache.wicket.markup.html.packageresourceguard':202C 'org.apache.wicket.request.resource.packageresource':101C 'packag':24B,105C,116C,365C,459C,467C,526C,543C 'paramet':157C 'part':337C 'path':4A,33B,89C,110C,130C,173C 'preced':175C 'prevent':380C 'qualifi':535C 'queri':156C 'rather':374C 'reachabl':422C,469C,513C 'read':51B,61B,473C 'read-on':472C 'recommend':585C 'refus':277C,443C 'render':492C,546C 'report':347C 'request':45B,49B,123C,445C 'requir':369C 'resourc':32B,106C,133C,544C 'respons':316C 'run':371C 'scope':114C 'script':498C 'separ':252C 'serv':260C 'session':79B,510C 'ship':394C 'shorter':283C,336C 'simpl':323C 'static':254C 'step1':351C 'stream':134C 'string':163C 'strip':226C 'structur':70B,486C 'style':7A,38B,139C,183C,294C,429C 'suffix':10A,231C 'suppli':295C 'support':576C,581C 'taken':42B 'target':525C 'templat':13A,57B,65B,213C,264C,274C,306C,483C,503C 'thing':251C 'three':146C 'time':234C 'togeth':136C 'underscor':178C,229C,333C,386C,419C 'underscore-delimit':228C 'unusu':363C 'upgrad':578C,587C 'url':124C,298C,540C 'user':75B,506C,564C,583C 'v2':348C 'valid':91C 'variat':39B,141C,182C 'version':582C,589C 'way':408C,515C 'web':26B 'web-app':25B 'whether':204C 'whose':414C 'wicket':2A,22B,29B,86C,393C,532C,551C,567C 'wizard':350C 'write':533C 'written':313C 'x':569C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, or 10.0.0 through 10.11.0 are exposed only if at least one component class simple name contains an underscore and no shorter part of that name is itself a class. Applications with no such class name are not affected. Teams running Wicket 7.x or older should move to a supported version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T23:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84177","severity":null,"published_at":"2026-11-01T23:17:30+00:00","modified_at":"2026-11-01T23:17:30+00:00","first_seen_at":"2026-11-01T23:22:40+00:00","fetched_at":"2026-11-01T23:22:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}