Severity: moderate
CVSS 4.0: 7.4 (high)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected versions:
- Apache Wicket (org.apache.wicket:wicket-extensions) 8.0.0 through 8.19.0
- Apache Wicket (org.apache.wicket:wicket-extensions) 9.0.0 through 9.24.0
- Apache Wicket (org.apache.wicket:wicket-extensions) 10.0.0 through 10.11.0
Description:
Improper neutralization of input during web page generation in Apache Wicket.
org.apache.wicket.extensions.markup.html.basic.SmartLinkLabel and
org.apache.wicket.extensions.markup.html.basic.SmartLinkMultiLineLabel display
a text value and turn any URL they find in it into a hyperlink. Both escape the
model value and then hand the escaped text to
org.apache.wicket.extensions.markup.html.basic.DefaultLinkParser, which
searches it for anything of the form scheme://rest and wraps each match in an
anchor whose href is the matched text, copied in as it is. The pattern accepts
any scheme, and there is no list of permitted schemes anywhere on the path. A
text value naming a scheme that executes script therefore becomes an anchor
that executes it, in the application's origin and in the reader's own session,
when the reader clicks the link. Rendering the page is not enough on its own;
the link has to be activated. Escaping does not prevent this and is not the
issue: the characters the payload needs are all valid in a URL and are ones
that org.apache.wicket.util.string.Strings#escapeMarkup() leaves alone, and the
value ends up in a URL rather than in element text, which is a context that
escaping model data does not make safe.
An application is affected where it renders text it received through either of
these two components. That is what they are for: they exist to linkify email
addresses and web URLs found in the data an application is displaying, so
untrusted input is the purpose of the feature rather than a misuse of it, and
no unusual configuration is involved. No other component uses this parser, and
an application that uses neither SmartLinkLabel nor SmartLinkMultiLineLabel is
not affected.
On 9.x and 10.x the Content-Security-Policy Wicket sends by default admits
script only from a source carrying a per-response nonce, and a URL whose scheme
executes script cannot carry one, so that default policy stops the script from
running. This is a property of the default policy and not of these components.
An application that has weakened or disabled its Content-Security-Policy, for
this or for any unrelated reason, is affected in full. Wicket 8.x has no
Content-Security-Policy support at all and is affected as it stands.
This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through
9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which
are no longer supported, should upgrade to a supported version. Users are
recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the
issue.
Credit:
Emond Papegaaij (finder)
References:
https://wicket.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-83539
