Apache Wicket CVE-2026-75802

Exploitation of the IChoiceRenderer path requires: (1) the application instantiates AjaxEditableChoiceLabel with a non-null custom IChoiceRenderer implementation, and (2) an attacker can influence the data from which that renderer derives its getDisplayValue() output - for example, via a form submission or API call that persists data into the choice list. Exploitation of the defaultNullLabel() path requires: (1) the application overrides defaultNullLabel() on AjaxEditableLabel, AjaxEditableChoiceLabel, or AjaxEditableMultiLineLabel, (2) the override returns a value the attacker can influence, and (3) the component's model evaluates to null at render time. Applications using these components with entirely static, developer-hardcoded choice lists and no defaultNullLabel() overrides are not exposed. The escapeModelStrings setting does not limit exploitation in any scenario - confirmed by the vendor as having no effect on these components. A third party viewing the affected page is required for impact (reflected in UI:R).

The vendor categorizes this as moderate severity, which is consistent with a conditional XSS whose exploitability depends on application-specific configuration choices rather than default framework behavior. Real-world risk is bounded by two independent preconditions: the application must deploy AjaxEditableChoiceLabel with a non-default IChoiceRenderer whose display values can be influenced by an attacker, or must override defaultNullLabel() to return attacker-controlled content. Neither condition exists in a default Wicket installation, materially narrowing the exposed population compared to a universal XSS. No EPSS data was present in the provided intelligence, the vulnerability does not appear in CISA KEV, and no public proof-of-concept code has been identified, all of which suggest limited opportunistic exploitation risk at this time. Despite these mitigating factors, the impact when conditions are met is non-trivial - session token theft via stored XSS can silently elevate attacker access - and even a mid-sized municipal IT team in tczew operating an internal Wicket-based workflow portal with custom renderer implementations should treat the available patch as an urgent upgrade rather than a deferred maintenance item. The clean vendor disclosure via oss-security, with explicit fixed versions across three maintained branches, reduces remediation friction significantly.

An attacker submits a crafted payload containing a script tag through a data entry channel that populates an IChoiceRenderer-backed choice list - for example, a product or user record stored in a database that feeds the component's model. When a legitimate user loads the page containing the AjaxEditableChoiceLabel, Wicket renders the unescaped display value directly into label markup, executing the injected script in the victim's browser and potentially exfiltrating session cookies or performing authenticated actions on the victim's behalf. No public proof-of-concept code has been identified at time of analysis.