Severity: low
Affected versions:
- Apache Answer through 2.0.2
Description:
Improper Neutralization of Input During Web Page Generation ('Cross-site
Scripting') vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
The importer stores imported question bodies as raw HTML without passing them
through the normal Markdown-to-HTML sanitization path, so attacker-controlled
HTML embedded in an imported data source is persisted and rendered to all
viewers (including privileged users) as stored XSS.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Credit:
meifukun (reporter)
References:
https://answer.apache.org
https://www.cve.org/CVERecord?id=CVE-2026-64944
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
