TomStrom16 commented on PR #1432: URL: https://github.com/apache/wicket/pull/1432#issuecomment-4418828860
According to the [CVE](https://www.cve.org/CVERecord?id=CVE-2026-43975) and [mailing list](https://lists.apache.org/thread/xp2jrdk6ppv1zcmxb4w1mk2lg1dw3hbr) Wicket 8 and 9 are also affected. I couldn't find the `IUploadsFileManager` and `FolderUploadsFileManager` in latest Wicket 8 (8.17.0). The only code that creates directories (I searched for mkdir in the wicket-core source for Wicket 8) is inside `DiskDataStore` and test code, but that has nothing to do with uploads. So my question: Is Wicket 8 really affected? Thanks in advance :-) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
