Most of the JVM applications use dependency management like Maven, Gradle, SBT these days.
It will be better if Wicket uses commons-fileupload as a dependency than to maintain a local copy of its classes (in wicket-util).
This way it won't be necessary to keep an eye on commons-upload for security fixes and any improvements will come for free.
- is related to
WICKET-5502 Patch FileUploadBase to fix CVE-2014-0050