SEPTEMBER 7, 2026
Live Feed
Back to database
Case File

CVE-2026-76985

MEDIUM · CVSS 5.4 EPSS 0.50%

Source: NVD + CISA KEV + EPSS · Published 2026-08-31 · Last synced 2026-09-07

CyberRota Analysis

AI-Generated

Apache Wicket is vulnerable due to improper input neutralization during web page generation, specifically in the rendering of option lists in the Palette component. This flaw can lead to potential injection attacks if applications override certain methods and do not properly escape user-controlled data. Organizations utilizing affected versions (8.0.0 to 8.18.0, 9.0.0 to 9.23.0, and 10.0.0 to 10.10.0) should prioritize upgrading to the patched versions to mitigate security risks.

CVE
CVE-2026-76985
Severity
MEDIUM
CVSS
5.4
EPSS
0.50%
Apache

Original NVD Description

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display value of each option according to the escape-model-strings setting, and wrote the attribute names and values returned by getAdditionalAttributes into the <option> tag as they came. An application is affected where it overrides Palette.getAdditionalAttributesForChoices, Palette.getAdditionalAttributesForSelection or AbstractOptions.getAdditionalAttributes and returns a value holding data an attacker can influence. These methods return null by default, so an application that does not override them is not affected. As a workaround, escape the values in the override. This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 1.4.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.

Related CVEs

Other vulnerabilities affecting the same vendor(s)