https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 04 Nov 2026 23:11:15 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-84172 <p>Files accessible to external parties in Apache Wicket.</p> <p>org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that separates a static HTML file, which may be served, from a component&#39;s markup template, which may not, is a check for a class file of the same name beside it. That check calls getResource() on the class loader that loaded wicket-core. The resource itself is reached through different class loaders: the scope class is resolved through the application&#39;s IClassResolver, which uses the thread context class loader, and org.apache.wicket.core.util.resource.ClassPathResourceFinder#find() then tries the scope class&#39; own loader, the context class loader, and the wicket-core loader last.</p> <p>Where wicket-core is loaded by a class loader that cannot see the application&#39;s classes, the check finds no class file, concludes the file is not a component markup template, and serves it. A request for the package resource URL of a component class then returns that component&#39;s markup template with status 200. What is disclosed is developer-authored template content: component structure, developer comments, markup that is rendered only under some conditions, inline script, and the endpoints a template names. Access is read-only, and no user data, credential or session material is reachable this way.</p> <p>Such a deployment is rare. The ordinary packaging,…</p> <p>Files accessible to external parties in Apache Wicket.</p> <p>org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that separates a static HTML file, which may be served, from a component&#39;s markup template, which may not, is a check for a class file of the same name beside it. That check calls getResource() on the class loader that loaded wicket-core. The resource itself is reached through different class loaders: the scope class is resolved through the application&#39;s IClassResolver, which uses the thread context class loader, and org.apache.wicket.core.util.resource.ClassPathResourceFinder#find() then tries the scope class&#39; own loader, the context class loader, and the wicket-core loader last.</p> <p>Where wicket-core is loaded by a class loader that cannot see the application&#39;s classes, the check finds no class file, concludes the file is not a component markup template, and serves it. A request for the package resource URL of a component class then returns that component&#39;s markup template with status 200. What is disclosed is developer-authored template content: component structure, developer comments, markup that is rendered only under some conditions, inline script, and the endpoints a template names. Access is read-only, and no user data, credential or session material is reachable this way.</p> <p>Such a deployment is rare. The ordinary packaging,…</p> https://db.gcve.eu/vuln/fkie_cve-2026-84172 https://db.gcve.eu/vuln/ghsa-3hjq-2xr3-p7px <p>Files accessible to external parties in Apache Wicket.</p> <p>org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that separates a static HTML file, which may be served, from a component&#39;s markup template, which may not, is a check for a class file of the same name beside it. That check calls getResource() on the class loader that loaded wicket-core. The resource itself is reached through different class loaders: the scope class is resolved through the application&#39;s IClassResolver, which uses the thread context class loader, and org.apache.wicket.core.util.resource.ClassPathResourceFinder#find() then tries the scope class&#39; own loader, the context class loader, and the wicket-core loader last.</p> <p>Where wicket-core is loaded by a class loader that cannot see the application&#39;s classes, the check finds no class file, concludes the file is not a component markup template, and serves it. A request for the package resource URL of a component class then returns that component&#39;s markup template with status 200. What is disclosed is developer-authored template content: component structure, developer comments, markup that is rendered only under some conditions, inline script, and the endpoints a template names. Access is read-only, and no user data, credential or session material is reachable this way.</p> <p>Such a deployment is rare. The ordinary packaging,…</p> <p>Files accessible to external parties in Apache Wicket.</p> <p>org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that separates a static HTML file, which may be served, from a component&#39;s markup template, which may not, is a check for a class file of the same name beside it. That check calls getResource() on the class loader that loaded wicket-core. The resource itself is reached through different class loaders: the scope class is resolved through the application&#39;s IClassResolver, which uses the thread context class loader, and org.apache.wicket.core.util.resource.ClassPathResourceFinder#find() then tries the scope class&#39; own loader, the context class loader, and the wicket-core loader last.</p> <p>Where wicket-core is loaded by a class loader that cannot see the application&#39;s classes, the check finds no class file, concludes the file is not a component markup template, and serves it. A request for the package resource URL of a component class then returns that component&#39;s markup template with status 200. What is disclosed is developer-authored template content: component structure, developer comments, markup that is rendered only under some conditions, inline script, and the endpoints a template names. Access is read-only, and no user data, credential or session material is reachable this way.</p> <p>Such a deployment is rare. The ordinary packaging,…</p> https://db.gcve.eu/vuln/ghsa-3hjq-2xr3-p7px