CVE-2016-6793

CVE-2016-6793 is a critical deserialization vulnerability affecting Apache Wicket versions 6.x before 6.25.0 and 1.5.x before 1.5.17. This flaw allows remote attackers to trigger an infinite loop, leading to a denial of service, and potentially write, move, or delete files with the permissions of the DiskFileItem class. Furthermore, on Java VMs older than 1.3.1, arbitrary code execution is possible. With a CVSS score of 9.1 (CRITICAL), it presents a high impact to integrity and availability, requiring no user interaction or authentication. While there are no known public exploits or active exploitation, the vulnerability has garnered significant community discussion, indicating awareness among security researchers.