CVE-2016-6793: Apache Wicket

Critical severity, CVSS 9.1. EPSS: 8.5% chance of exploitation in the next 30 days.

The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem, and if running on a Java VM before 1.3.1, execute arbitrary code via a crafted serialized Java object.

Affected products

• Apache Wicket: from 1.5.0, before 1.5.17 (fixed in 1.5.17); from 6.0.0, before 6.25.0 (fixed in 6.25.0)

Published 2017-07-17. Last modified 2026-06-17.