CVE-2026-76982— Apache Wicket: XSS in Button via its model object
Quick assessment
Affected
Apache Software Foundation Apache Wicket
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Apache Wicket 中，在生成网页时对输入进行不当中和处理。 在其构造函数中清除了 标志，因此它写入的 value 属性不会被双重编码——因为 在写入标签时已经对属性值进行了编码。这一逻辑仅适用于属性。当该组件被附加到 元素（而非 ）时，它会将模型对象写入元素主体（body）中，而没有任何机制对元素主体进行编码，因此模型中的标记内容会被直接作为标记渲染。 在以下场景下，应用程序将受到影响：当它在一个 元素上渲染 Button，且该按钮的模型持有攻击者可以影响的数据时。由于 Wicket 无法判断模型值的
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76982
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Wicket: XSS in Button via its model object
Source: CVE Program / CVE List V5
Vulnerability Description
Improper neutralization of input during web page generation in Apache Wicket.
org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag already encodes attribute values when it writes the tag. That reasoning holds only for the attribute. When the component is attached to a <button> element rather than an <input>, it writes its model object into the element body instead, and nothing encodes an element body, so markup in the model is rendered as markup.
An application is affected where it renders a Button on a <button> element and that button's model holds data an attacker can influence. Wicket cannot determine where a model value comes from, so whether it reaches the page from a request or from storage is a property of the application. The subclasses that inherit this constructor — AjaxButton, AjaxFallbackButton and WizardButton — are affected on the same terms.
As a workaround, calling setEscapeModelStrings(true) on a button that renders as a <button> element escapes the body correctly, and does not cause double encoding, because the value attribute is written only for <input> elements.
This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 6.25.0 and 7.5.0 onwards are also affected.
Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/U:Amber
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Wicket | 8.0.0 ~ 8.18.0 | - |
|
II. Public POCs for CVE-2026-76982
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76982
请登录查看更多情报信息。
Other References for CVE-2026-76982 (1)
-
https://lists.apache.org/thread/bhcfrz61o4bv0olktybvgqft8km9wfrd vendor-advisory
Same Patch Batch · Apache Software Foundation · 2026-08-31 · 8 CVEs total
| CVE-2026-58301 | 5.9 MEDIUM | Apache Shiro: Server-side POST request may be steered to an alternate host |
| CVE-2026-76983 | 5.1 MEDIUM | Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel |
| CVE-2026-76984 | 5.1 MEDIUM | Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute |
| CVE-2026-75802 | 5.1 MEDIUM | Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and default |
| CVE-2026-71378 | Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationReq | |
| CVE-2026-71257 | Apache Wicket: Configured file upload limits are not enforced when the multipart request h | |
| CVE-2026-70449 | Apache Wicket: Path traversal in resource style/variation/locale |
IV. Related Vulnerabilities
Same product: Apache Wicket
-
CVE-2026-76983
Apache Wicket: XSS in AutoLabelTextResolver via FormComponen -
CVE-2026-76984
Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute -
CVE-2026-75802
Apache Wicket: XSS in AjaxEditableLabel and its subclasses v -
CVE-2026-71378
Apache Wicket: Cross-Site Request Forgery (CSRF) protection -
CVE-2026-71257
Apache Wicket: Configured file upload limits are not enforce
Same vendor: Apache Software Foundation
-
CVE-2026-76983
Apache Wicket: XSS in AutoLabelTextResolver via FormComponen -
CVE-2026-76984
Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute -
CVE-2026-75802
Apache Wicket: XSS in AjaxEditableLabel and its subclasses v -
CVE-2026-71378
Apache Wicket: Cross-Site Request Forgery (CSRF) protection -
CVE-2026-71257
Apache Wicket: Configured file upload limits are not enforce
Same weakness: CWE-79
-
CVE-2026-76983
Apache Wicket: XSS in AutoLabelTextResolver via FormComponen -
CVE-2026-76984
Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute -
CVE-2026-75802
Apache Wicket: XSS in AjaxEditableLabel and its subclasses v -
CVE-2026-82881
Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdow -
CVE-2026-82868
@pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG
V. Comments for CVE-2026-76982
No comments yet