Apache Wicket & Shiro: Ten Vulnerabilities Disclosed in Single Batch
A batch of ten vulnerabilities affecting Apache Wicket and Apache Shiro were disclosed on August 31, 2026, with impacts ranging from file disclosure to SSRF.
Key findings
- Ten vulnerabilities disclosed for Apache Wicket and Apache Shiro on August 31, 2026.
- Multiple Apache Wicket CVEs involve improper input neutralization and HTML escaping issues in web page generation.
- CVE-2026-70449 allows unauthenticated remote attackers to read sensitive files, including those in WEB-INF.
- CVE-2026-58301 in Apache Shiro enables SSRF attacks via crafted HTTP requests.
- Users should update Apache Wicket and Apache Shiro (versions 2.x-3.0.0 with Jakarta EE integration) to patched versions.
On August 31, 2026, a batch of ten vulnerabilities was disclosed for Apache Wicket and Apache Shiro. The vulnerabilities, disclosed within a six-hour window, primarily concern improper input neutralization during web page generation in Apache Wicket, with one additional vulnerability in Apache Shiro's Jakarta EE integration. These issues could allow attackers to read sensitive files, execute cross-site scripting (XSS) attacks, or facilitate server-side request forgery (SSRF) attacks.
Several CVEs in the Apache Wicket batch relate to how the framework handles user-provided input within HTML attributes and tags. CVE-2026-76986, affecting AbstractSingleSelectChoice, and CVE-2026-76985, impacting AbstractOptions, both involve improper neutralization of input that could lead to the rendering of unescaped data in the markup. Similarly, CVE-2026-76984, related to MetaDataHeaderItem, improperly escapes attribute values, potentially leading to injection vulnerabilities. CVE-2026-76983, concerning the <wicket:label> tag, writes label content directly into the markup without escaping, posing a risk if the label content is influenced by user input. CVE-2026-76982, found in org.apache.wicket.markup.html.form.Button, also involves improper handling of the escape-model-strings flag, potentially leading to double encoding or other unintended behaviors.
Further Wicket vulnerabilities include CVE-2026-75802, where AjaxEditableChoiceLabel fails to HTML-escape display values from a provided IChoiceRenderer, potentially enabling XSS attacks. CVE-2026-71378, related to ResourceIsolationRequestCycleListener, addresses a potential cross-site request forgery (CSRF) vulnerability by improving its default policy for resource isolation. CVE-2026-71257 describes a scenario where Wicket falls back to reading upload data through HttpServletRequest#getInputStream if the request body has already been consumed, potentially bypassing upload limits. A more severe vulnerability, CVE-2026-70449, allows an unauthenticated remote attacker to read arbitrary files from the web application, including sensitive files under WEB-INF, by manipulating resource URL attributes.
The batch also includes CVE-2026-58301, affecting Apache Shiro's Jakarta EE integration. This vulnerability allows a low-privileged user to craft a request that forces the server to connect to an attacker-controlled URL and transmit attacker-controlled data, a form of SSRF. This specific vulnerability impacts Apache Shiro versions 2.x through 3.0.0 when deployed with the Jakarta EE integration module.
The disclosed vulnerabilities in Apache Wicket appear to stem from a common theme of improper input handling and escaping mechanisms within its component rendering and resource management. While specific patch versions were not detailed for all Wicket CVEs, the collective disclosure suggests that users should review their Wicket application configurations and update to the latest available versions to mitigate these risks. For Apache Shiro, users of versions 2.x through 3.0.0 with the Jakarta EE integration should apply available patches immediately. These vulnerabilities underscore the importance of diligent input validation and secure handling of user-supplied data in web applications.