The user asked in Github, not on dev@ mailing list. On Mon, May 11, 2026 at 4:19 PM Andrea Del Bene <[email protected]> wrote:
> Hi, > > yep, you are right, Wicket 8.x doesn't contain that component so it's > not affected . I will remove 8.x from the affected version. > > On Mon, May 11, 2026 at 10:28 AM TomStrom16 (via GitHub) <[email protected]> > wrote: > > > > > > TomStrom16 commented on PR #1432: > > URL: https://github.com/apache/wicket/pull/1432#issuecomment-4418828860 > > > > According to the [CVE]( > https://www.cve.org/CVERecord?id=CVE-2026-43975) and [mailing list]( > https://lists.apache.org/thread/xp2jrdk6ppv1zcmxb4w1mk2lg1dw3hbr) Wicket > 8 and 9 are also affected. > > > > I couldn't find the `IUploadsFileManager` and > `FolderUploadsFileManager` in latest Wicket 8 (8.17.0). The only code that > creates directories (I searched for mkdir in the wicket-core source for > Wicket 8) is inside `DiskDataStore` and test code, but that has nothing to > do with uploads. > > > > So my question: Is Wicket 8 really affected? > > > > Thanks in advance :-) > > > > > > -- > > This is an automated message from the Apache Git Service. > > To respond to the message, please log on to GitHub and use the > > URL above to go to the specific comment. > > > > To unsubscribe, e-mail: [email protected] > > > > For queries about this service, please contact Infrastructure at: > > [email protected] > > > > > -- > Andrea Del Bene. > Apache Wicket committer. >
