Apache Wicket CVE-2026-84177

The application must contain a Wicket component class whose simple name includes an underscore and for which no shorter underscore-delimited prefix is itself a class - for example Report_v2 or Wizard_Step1; applications with no such class name are not affected. No unusual deployment, packaging, or configuration is required, and running in deployment rather than development mode does not prevent it. The attacker must name both the target package and the component class, which is feasible because Wicket writes fully-qualified class names into the URL of every package resource it renders. Exploitation is inherently limited: it is remote and requires no authentication (PR:N) but is read-only, reaches only HTML files within the component's own package (the appended attributes cannot change the file extension or leave the package), and discloses only developer-authored template content - never user data, credentials, or session material. No Wicket-shipped module uses an underscore in a class name, so no framework markup is exposed.

The vendor-assigned CVSS 4.0 score is 6.3 (Medium) with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, and the signals are internally consistent: network-reachable (AV:N) and requiring no privileges (PR:N), but carrying an explicit attack requirement (AT:P) and only low confidentiality impact (VC:L) with no integrity or availability impact. That AT:P is the decisive moderating signal - exploitation is contingent on the target application itself containing a component class whose simple name has an underscore (e.g. Report_v2) with no shorter prefix that is also a class; an application without such a class name is simply not affected, so this is a conditional rather than universal exposure. No EPSS score was provided in the input and the issue is not listed in CISA KEV, so there is no public evidence of active exploitation; there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', not act_now or emergency, which matches the overall picture: a genuine but bounded, read-only information-disclosure flaw rather than a high-urgency crisis. What is disclosed is developer-authored HTML template content (component structure, comments, conditionally-rendered markup, inline script, named endpoints) scoped to a single package - explicitly not user data, credentials, or session material - so even on a vulnerable application the practical impact is reconnaissance-grade information leakage. This is a real but lower-tier priority: patch it on schedule, with higher urgency for applications known to use underscore-containing component class names.

A remote, unauthenticated attacker observes a fully-qualified component class name that Wicket writes into package-resource URLs, identifies one whose simple name contains an underscore (such as Wizard_Step1), and requests that resource with a crafted style supplied via the first query parameter. The PackageResourceGuard validates a shortened base name for which no class file exists and approves it, after which ResourceNameIterator appends the attacker-supplied style and completes the path into the component's markup template, which is returned in the response. No public exploit is identified at time of analysis, and the attack succeeds only if such an underscore-named class exists in the application.