Hi, yep, you are right, Wicket 8.x doesn't contain that component so it's not affected . I will remove 8.x from the affected version.
On Mon, May 11, 2026 at 10:28 AM TomStrom16 (via GitHub) <[email protected]> wrote: > > > TomStrom16 commented on PR #1432: > URL: https://github.com/apache/wicket/pull/1432#issuecomment-4418828860 > > According to the [CVE](https://www.cve.org/CVERecord?id=CVE-2026-43975) > and [mailing > list](https://lists.apache.org/thread/xp2jrdk6ppv1zcmxb4w1mk2lg1dw3hbr) > Wicket 8 and 9 are also affected. > > I couldn't find the `IUploadsFileManager` and `FolderUploadsFileManager` > in latest Wicket 8 (8.17.0). The only code that creates directories (I > searched for mkdir in the wicket-core source for Wicket 8) is inside > `DiskDataStore` and test code, but that has nothing to do with uploads. > > So my question: Is Wicket 8 really affected? > > Thanks in advance :-) > > > -- > This is an automated message from the Apache Git Service. > To respond to the message, please log on to GitHub and use the > URL above to go to the specific comment. > > To unsubscribe, e-mail: [email protected] > > For queries about this service, please contact Infrastructure at: > [email protected] > -- Andrea Del Bene. Apache Wicket committer.
