Apache Wicket CVEs, Shiro SSRF, Exiv2 fixes

Apache projects disclosed multiple moderate vulnerabilities in Wicket and one in Shiro, while Exiv2 issued a security release. The Wicket issues cover upload limits, CSRF, XSS, and path traversal in the web framework.

Apache Wicket upload limits bypassed after multipart parse

Apache Wicket reported CVE-2026-71257, a moderate-severity flaw in which configured file size and count limits are not enforced when the multipart request body has already been parsed. Applications that rely on Form upload restrictions may accept oversized or excess files. Framework users should assess pre-parsed request handling to avoid resource abuse.

Apache Wicket CSRF protection bypass in resource listener

CVE-2026-71378 describes a moderate bypass of CSRF protections in Apache Wicket's ResourceIsolationRequestCycleListener. The issue can allow cross-origin invocations of the listener. Deployments that depend on this listener for origin isolation need to review the advisory and apply available updates.

Apache Shiro SSRF via steered POST requests

Apache Shiro disclosed CVE-2026-58301, enabling a server-side POST request to be steered to an alternate host through the Jakarta EE module in versions 2.x through 3.0.0. The moderate issue can produce SSRF in affected configurations. Operators of Shiro-based services should check module usage and upgrade accordingly.

Apache Wicket XSS via Button model object

CVE-2026-76982 covers a moderate XSS vulnerability in Apache Wicket's Button component when its model object is rendered inside a button element rather than an input. Untrusted model content can execute in the browser. Developers rendering dynamic button labels should treat the disclosure as a prompt to sanitize or upgrade.

Apache Wicket path traversal in resource style handling

Apache Wicket published CVE-2026-70449, a moderate path traversal flaw involving resource style, variation, and locale parameters that can allow reading of WEB-INF files. The issue affects resource resolution paths. Applications serving localized or styled resources should apply the fix to prevent unauthorized file access.

Apache Wicket XSS in AjaxEditableLabel and choice renderer

CVE-2026-75802 is a moderate XSS advisory for Apache Wicket's AjaxEditableLabel and subclasses, stemming from incomplete escaping with IChoiceRenderer and defaultNullLabel. Crafted labels can inject script content. Users of these editable components should update to close the escaping gap.

Exiv2 0.28.9 security release

Exiv2 0.28.9 was released to address one moderate and six low-severity vulnerabilities, most related to RemoteIo URL handling. The update hardens metadata processing against the reported flaws. Projects that parse image metadata with Exiv2 should move to this version.