Apache Wicket: Remote code execution via XSLT injection

CRITICAL 9.8CVE-2024-36522 · GHSA-hhwc-gh8h-9rrp · Published 12/07/2024 · updated 17/06/2026

In short

CVE-2024-36522 is a CRITICAL (CVSS 9.8) vulnerability affecting org.apache.wicket:wicket-util, wicket (apache).
Chance of exploitation in the next 30 days (EPSS): 2.1%, higher than 81.9% of all vulnerabilities.
Fix: update to 10.1.0, 8.16.0, 9.18.0 or later.

Package	Affected versions	Patched versions
org.apache.wicket:wicket-util Maven	`≥ 10.0.0-M1, < 10.1.0≥ 8.0.0, < 8.16.0≥ 9.0.0, < 9.18.0`	`10.1.08.16.09.18.0`
wicket apache	`= 10.0.0≥ 8.0.0, < 8.16.0≥ 9.0.0, < 9.18.0`	`8.16.09.18.0`

Description

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2024-36522 · ADVISORY
apache/wicket · PACKAGE
lists.apache.org/thread/w613qh7yors840pbx00l1pq6wkl9jzkc · WEB
openwall.com/lists/oss-security/2024/07/12/2 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free