Apache Wicket 10.11.0 released

1 New and noteworthy
2 Using this release
3 Upgrading from earlier versions
- 3.1 This Release

30 Aug 2026

The Apache Wicket PMC is proud to announce Apache Wicket 10.11.0!

Apache Wicket is an open source Java component oriented web application framework that powers thousands of web applications and web sites for governments, stores, universities, cities, banks, email providers, and more. You can find more about Apache Wicket at https://wicket.apache.org

This release marks another minor release of Wicket 10. We use semantic versioning for the development of Wicket, and as such no API breaks are present in this release compared to 10.0.0.

New and noteworthy

This release fixes the following CVE:

CVE-2026-70449 Path traversal in resource style/variation/locale
CVE-2026-71257 Configured file upload limits are not enforced when the multipart request has already been parsed
CVE-2026-71378 Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener
CVE-2026-75802 XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel
CVE-2026-76982 XSS in Button via its model object
CVE-2026-76983 XSS in AutoLabelTextResolver via FormComponent.setLabel
CVE-2026-76984 XSS in MetaDataHeaderItem via addTagAttribute
CVE-2026-76985 XSS in Palette via getAdditionalAttributes
CVE-2026-76986 XSS in AbstractSingleSelectChoice via getNullValidDisplayValue

Using this release

With Apache Maven update your dependency to (and don’t forget to update any other dependencies on Wicket projects to the same version):

<dependency>
    <groupId>org.apache.wicket</groupId>
    <artifactId>wicket-core</artifactId>
    <version>10.11.0</version>
</dependency>

Or download and build the distribution yourself, or use our convenience binary package you can find here:

Download: http://wicket.apache.org/start/wicket-10.x.html#manually

Upgrading from earlier versions

If you upgrade from 10.y.z this release is a drop in replacement. If you come from a version prior to 10.0.0, please read our Wicket 10 migration guide found at

http://s.apache.org/wicket10migrate

Have fun!

— The Wicket team

========================================================================

This Release

CHANGELOG for 10.11.0:

New Feature

[WICKET-7196] - Allow unescaped wicket:label tags

Improvement

[WICKET-7192] - restrict SourcesPage to resources of the page’s own package
[WICKET-7195] - Add tag type=”search” to those supported by TextField

Task

[WICKET-7193] - Deprecate and remove IAuthenticationStrategy

Table of Contents