Apache Wicket incorrectly validates resource URL attributes, allowing an unauthenticated remote attacker to read files from the web application, including those under WEB-INF that are not normally served. The flaw arises because locale, style, and variation parameters decoded from a package resource URL are concatenated into the lookup path without checking for path separators, bypassing the intended guard controls. This permits local file disclosure and, depending on guard configuration, can expose configuration files such as web.xml.

The vulnerability affects Apache Wicket 8.18.0 and earlier, 9.23.0 and earlier, and 10.10.0 and earlier. Users running Apache Wicket 7.x or older, which are no longer supported, should migrate to a supported version as well.

An unauthenticated attacker can craft a request with specially encoded locale, style, or variation parameters to trigger traversal outside the intended resource package. The exploit requires no authentication or elevated privileges and can be triggered from any remote client. While no CVSS score is publicly published and the EPSS score is not available, the ability to read sensitive files elevates the risk. The vulnerability is not listed in CISA's KEV catalog.