CVE-2026-95863 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Wicket applications should assess exposure and prioritize upgrading to a fixed version. They should verify the versions of Apache Wicket in use, check if any markup id or component id carries special characters that could be used for injection, and implement Content Security Policy to prevent injection.

Why it matters

Defenders should prioritize upgrading to version 8.20.0, 9.25.0, or 10.12.0, which fix the issue. They should also assess exposure by checking if any markup id or component id carries special characters that could be used for injection.

• Injection of malicious script code
• Potential for XSS attacks via specially crafted markup ids or component ids
• Exposure of sensitive data or unauthorized actions

Technical summary

Apache Wicket generates JavaScript that refers to the elements it renders, and writes into that JavaScript two values it derives itself: a component's markup id, and the input name of a form component. These values are not properly escaped, allowing an attacker to inject malicious script code. The vulnerability affects Apache Wicket from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, and from 10.0.0 through 10.11.0. The fixed versions check an id where it enters instead of escaping each place it is written. A component id and a markup id may no longer contain a quote, a backquote, a backslash, braces, angle brackets, a semicolon, an ampersand or a control character, and a markup id may not contain parentheses

Defensive priority

Defenders should prioritize upgrading to version 8.20.0, 9.25.0, or 10.12.0, which fix the issue. They should also assess exposure by checking if any markup id or component id carries special characters that could be used for injection.

Recommended defensive actions

• Upgrade to version 8.20.0, 9.25.0, or 10.12.0
• Assess exposure by checking markup ids and component ids for special characters
• Implement Content Security Policy to prevent injection
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, its impact, and the affected versions of Apache Wicket. The vulnerability allows an attacker to inject malicious script code due to improper neutralization of input during web page generation. This issue affects Apache Wicket from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, and from 10.0.0 through 10.11.0. Defenders should verify the versions of Apache Wicket in use and assess exposure. The fixed versions check an id where it enters instead of

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.