Apache Wicket EUVD-2026-27653

The vulnerability requires that the vulnerable Wicket FolderUploadsFileManager component be instantiated and actively used by the application for file uploads. The attack is possible only if the application exposes file upload functionality that directly uses the FolderUploadsFileManager class without additional input sanitization in the application layer. No special configuration is required on the server; default or standard Wicket upload configurations are exploitable. The vulnerability does NOT require the attacker to be authenticated, does NOT require user interaction on the server, and does NOT depend on non-default feature enablement. Attack success depends on the file system permissions of the web application process (typically the Tomcat or application server user) - if the process can read/write to the target path, the attacker can exploit it. Exploitation is limited to file system operations accessible by the application process; system-level protections (SELinux, AppArmor) or restrictive file permissions may constrain damage scope.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates a medium-severity vulnerability with network vector, low attack complexity, no privilege or user interaction requirements, and limited confidentiality and integrity impact. The EPSS score of 0.04% (percentile 11%) is notably low despite the network-accessible vector, suggesting minimal real-world exploitation prevalence at analysis time. SSVC decision framework data ('Exploitation: none, Automatable: yes, Technical Impact: partial') supports this discrepancy - while the attack is technically automatable via HTTP requests, no confirmed public exploitation has been observed. The combination of low EPSS and absent KEV status indicates this is a low-probability-exploitation-in-practice vulnerability, despite being remotely triggerable. The manual path canonicalization validation added in the patch (checking against toRealPath() and startsWith() comparison) confirms the root cause and that the fix is targeted and effective. Organizations using Wicket for file upload functionality should prioritize patching, but urgent incident response is not warranted by exploitation signals alone.

An attacker sends an HTTP POST request to a Wicket application's file upload endpoint with a malicious uploadFieldId parameter containing path traversal sequences (e.g., '../../../') or a crafted clientFileName (e.g., '../../etc/passwd'). The FolderUploadsFileManager component fails to validate these inputs, allowing the attacker to read sensitive files from the server (e.g., configuration, credentials) or write malicious files outside the upload directory (e.g., JSP shells in web-accessible directories). No authentication or user interaction is required.