CVE-2016-6793
CriticalSummary
The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem. Additionally, if running on a Java VM before 1.3.1, it can execute arbitrary code via a crafted serialized Java object.
Risk Assessment
This vulnerability can lead to serious availability issues and allow attackers to gain unauthorized access to files and execute malicious code, posing a threat to data integrity and confidentiality.
Recommendation
It is recommended to update Apache Wicket to version 6.25.0 or 1.5.17 and to monitor systems for suspicious activity related to files and executable code.
Other vulnerabilities in Apache Wicket
See all- CVE-2026-43646High
Apache Wicket has a vulnerability that exposes sensitive information to unauthorized actors. This affects versions from 8.0.0 to 8.17.0, from 9.0.0 to 9.22.0, and from 10.0.0 to 10.8.0.
- CVE-2014-3526High
Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via identifiers for storing page markup for temporary user sessions.
- CVE-2016-6806High
Apache Wicket versions 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 contain a security vulnerability that improperly handles CSRF prevention, failing to detect some cross-origin requests. The issue also involves not checking all Wicket server-side targets.
- CVE-2014-7808High
Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider.
- CVE-2026-76986Medium
A cross-site scripting (XSS) vulnerability was found in Apache Wicket in AbstractSingleSelectChoice (base class of DropDownChoice). The default option body is written without escaping, while other options are escaped. Applications overriding getNullValidDisplayValue() or getNullKeyDisplayValue() with attacker-influenced data are affected. Versions 8.0.0-8.18.0, 9.0.0-9.23.0, 10.0.0-10.10.0 are affected.
- CVE-2026-76985Medium
A cross-site scripting (XSS) vulnerability was found in Apache Wicket in AbstractOptions (renders option lists in Palette). Attribute names and values from getAdditionalAttributes are written without escaping. Applications overriding getAdditionalAttributesForChoices, getAdditionalAttributesForSelection, or getAdditionalAttributes with attacker-influenced data are affected. Versions 8.0.0-8.18.0, 9.0.0-9.23.0, 10.0.0-10.10.0 are affected.
- CVE-2026-76984Medium
In Apache Wicket, the MetaDataHeaderItem component improperly neutralizes input during web page generation. Attribute values in <meta> and <link> tags are not properly escaped, allowing injection of additional attributes. Affects versions from 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0.
- CVE-2026-76983Medium
In Apache Wicket, the <wicket:label> tag is rendered without escaping, allowing HTML injection if the label comes from a model containing attacker-controlled data. Affects versions from 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0.
- CVE-2026-76982Medium
XSS vulnerability in Apache Wicket affects the Button component rendered as a <button> element. The constructor clears the escape-model-strings flag, so the model is not encoded when written to the element body, allowing markup injection.
- CVE-2026-75802Medium
XSS vulnerability in Apache Wicket affects AjaxEditableChoiceLabel, AjaxEditableLabel, and AjaxEditableMultiLineLabel components. Displayed label values are not properly escaped, allowing an attacker to inject HTML or scripts. Affected versions: 8.0.0-8.18.0, 9.0.0-9.23.0, 10.0.0-10.10.0.
Original NVD description (English source)
The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem, and if running on a Java VM before 1.3.1, execute arbitrary code via a crafted serialized Java object.