CVE DatabaseCVE-2026-111089

Updated 2026-11-06한국어 권고문 →

CVE-2026-1110897.6/HIGHCWE-79

Apache Wicket Cross-Site Scripting (XSS) Vulnerability due to Missing Resource Bundle Escaping (CVE-2026-111089)

⚡ Jump to Patch

Affected Vendors

apache

Affected Components

wicket

Published Date

2026-11-01

CVSS v3.1

7.6

HIGH

EPSS (30d)

0.3%

FIRST.org

CISA KEV

Not Listed

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0

Impact

Unescaped resource bundle texts written into JavaScript literals and HTML attributes allow arbitrary script execution under the application's origin

Mitigation

Immediately upgrade Apache Wicket to patched versions 8.20.0, 9.25.0, or 10.12.0 or higher

Affected Products & Version Scope

Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 (including unsupported 7.x and older versions)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Update your Maven or Gradle build configuration to use the patched versions of Apache Wicket (8.20.0, 9.25.0, or 10.12.0 or higher).

Maven (pom.xml) Update Example:

xml

<properties>
    <!-- Set to 8.20.0, 9.25.0, or 10.12.0+ depending on your current major version -->
    <wicket.version>10.12.0</wicket.version>
</properties>

<dependencies>
    <dependency>
        <groupId>org.apache.wicket</groupId>
        <artifactId>wicket-core</artifactId>
        <version>${wicket.version}</version>
    </dependency>
    <dependency>
        <groupId>org.apache.wicket</groupId>
        <artifactId>wicket-extensions</artifactId>
        <version>${wicket.version}</version>
    </dependency>
</dependencies>

2. Temporary Workaround & Hardening Configuration

If an immediate upgrade is not feasible, audit your localization resource bundle files (*.properties) and temporarily remove or replace apostrophes (') and quotes (") in keys used by the affected components (e.g., org.apache.wicket.mfu.delete, UploadProgressBar.starting). Additionally, configure Web Application Firewall (WAF) rules to detect and block common XSS payloads and inline event handlers.

3. Log Audit & IoC Verification Commands

Use the following commands to scan your project dependencies and identify potentially vulnerable Wicket versions and risky resource bundle entries.

bash

# Check Maven dependency tree for vulnerable Wicket versions
mvn dependency:tree | grep -E 'org.apache.wicket:wicket-(core|extensions)'

# Scan localization properties files for apostrophes that could trigger the vulnerability
find . -name '*.properties' -exec grep -H "'" {} \;

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

To secure your application, immediately upgrade Apache Wicket to version 8.20.0, 9.25.0, or 10.12.0 or higher.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2026-111089) exists in the Apache Wicket framework, which reads localized labels, CSS class names, and other texts from the application's resource bundles and writes them into generated JavaScript and markup. While Wicket properly escapes these texts when rendering them as standard element text, it fails to perform context-aware escaping when placing them inside single-quoted JavaScript string literals or quoted HTML attribute values. Consequently, any text containing an ordinary apostrophe or quote can prematurely terminate the literal or attribute, causing the subsequent payload to be parsed as executable script or markup.

2. Exploitation Mechanics & Attack Scenario

The vulnerability manifests in several core and extension components:

wicket-core:
MultiFileUploadField writes the org.apache.wicket.mfu.delete message into a JavaScript string literal.
Form and Form#appendDefaultButtonField write the hidden-fields CSS class into the container's class attribute.
wicket-extensions:
UploadProgressBar writes UploadProgressBar.starting into a JavaScript string literal.
FilterForm writes the hidden-fields CSS class into the class attribute of its hidden input markup.
TrapFocusBehavior writes its current CSS class into a JavaScript string literal.

Notably, the default Content-Security-Policy (CSP) shipped with Apache Wicket 9.x and 10.x does not mitigate the JavaScript injection vectors. Because the framework writes the generated script into a script element carrying a per-response nonce, the injected malicious payload is executed as part of a trusted, policy-admitted script.

3. Infrastructure & Business Impact

If an attacker can influence the resource bundle contents or if user-controlled inputs are dynamically reflected into the resource bundle mechanism, this leads to a severe Cross-Site Scripting (XSS) condition. Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser session, leading to session hijacking, credential theft, defacement, or unauthorized actions within the application's origin.

Official Vendor Advisories & References

NVD Original English Description

Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute values without being escaped for that context, so a text containing a quote ends the literal or the attribute, and what follows is parsed as script or as markup in the application's origin when the page loads. A resource bundle entry is authored for the application and does not say where the framework will write it. The same key is read by the framework into element text, where Wicket escapes it, and into the contexts below, where it did not. A text containing an apostrophe, which is ordinary in several languages, is enough to break the page; a text under the influence of another party is enough to run script. In org.apache.wicket:wicket-core, org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes the org.apache.wicket.mfu.delete message into a JavaScript string literal, and org.apache.wicket.markup.html.form.Form writes the hidden-fields css class into the class attribute of the container it renders for its hidden fields; on 8.0.0 through 8.19.0 and 9.0.0 through 9.24.0 Form#appendDefaultButtonField writes the same css class into a second container. In org.apache.wicket:wicket-extensions, UploadProgressBar writes its UploadProgressBar.starting text into a JavaScript string literal, FilterForm writes the hidden-fields css class into the class attribute of its hidden input markup, and on 9.0.0 through 9.24.0 and 10.0.0 through 10.11.0 TrapFocusBehavior writes its current css class into a JavaScript string literal. The Content-Security-Policy that Apache Wicket 9.x and 10.x send by default does not prevent the JavaScript cases: the generated script is written into a script element carrying the per-response nonce, so the injected code is part of a script the policy admits. It does prevent an inline event handler injected through the attribute cases. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.

https://lists.apache.org/thread.html/xyp4sm5mm7s618fktstb22577qxbmqw8

Source: security@apache.org

Frequently Asked SecOps Questions (CVE-2026-111089)

FAQ

Q1. How critical is CVE-2026-111089 and is it actively exploited in the wild?

CVE-2026-111089 is rated CVSS 7.6 (HIGH) with a 30-day EPSS exploitation probability of 0.3%. Organizations running affected versions should prioritize patching based on network exposure.

Q2. Which vendors and products are affected by CVE-2026-111089?

Primary impacted vendors include apache across wicket. Scope summary: Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 (including unsupported 7.x and older versions)

Q3. What temporary mitigations or workarounds exist for CVE-2026-111089 before patching?

[Mitigation] Immediately upgrade Apache Wicket to patched versions 8.20.0, 9.25.0, or 10.12.0 or higher Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION

Generate an Internal Engineering Notice or CISO Report for CVE-2026-111089

Instantly format this advisory into an executive CISO summary or engineering patch ticket.

Generate Report →

CVSS v3.1 MetricsNVD BASE

7.6/ 10.0

HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Scoring AuthorityApache Security (CNA)

Assigning CNA / VendorNIST NVD Official Record

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionP

ScopeX

ConfidentialityN/A

IntegrityN/A

AvailabilityN/A

Exploitation Telemetry

EPSS Probability (30d)0.3%

CISA KEV CatalogNot Listed

Public Exploit / PoCUnconfirmed

Official Vendor PSIRTDIRECT LINKS

MITRE CVE.org & CWE Registry

MITRE Official CVE Record & CNA Registry · CVE-2026-111089 Direct

Apache Software Foundation Security

Apache Software Foundation Security Team · CVE-2026-111089 Direct

Technical Classification

apache-wicket xss cwe-79 resource-bundle injection

🔗 Related Advisories in Similar Stack (apache)

View Category →

CVE-2026-821156.3/MEDIUM

EPSS 0.3%

Apache Wicket WebSocket Resource Missing Authorization Vulnerability (CVE-2026-82115) Analysis & Mitigation Guide

[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, 10.0.0 to 10.11.0, and unsupported 7.x releases

CVE-2026-829567.6/HIGH

EPSS 0.3%

Apache Wicket AjaxNewWindowNotifyingBehavior Cross-Site Scripting (XSS) Vulnerability (CVE-2026-82956)

[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0, specifically when AjaxNewWindowNotifyingBehavior is explicitly used

CVE-2026-835397.4/HIGH

EPSS 0.3%

Apache Wicket SmartLinkLabel Cross-Site Scripting (XSS) Vulnerability (CVE-2026-83539)

[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0 utilizing SmartLinkLabel or SmartLinkMultiLineLabel components

CVE-2026-835597.4/HIGH

EPSS 0.3%

Apache Wicket JavaScriptUtils Escape Bypass Remote Script Execution Vulnerability (CVE-2026-83559)

[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, 10.0.0 to 10.11.0, and unsupported 7.x or older versions

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed:

PatchKO