CVE-2026-34033: Apache Answer: HTML Content Injection in Email
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.0.
User-supplied content was included in notification emails without proper escaping, allowing authenticated users to inject arbitrary HTML into emails sent to other users. Users are recommended to upgrade to version 2.0.1, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Answerto a version that resolves this vulnerability.Fixed in 2.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34033?
The severity of CVE-2026-34033 is rated as medium with a CVSS score of 5.4.
How do I fix CVE-2026-34033?
To fix CVE-2026-34033, ensure that user-supplied content is properly escaped before including it in notification emails.
What type of vulnerability is CVE-2026-34033?
CVE-2026-34033 is an HTML content injection vulnerability, categorized as a basic XSS issue.
What versions of Apache Answer are affected by CVE-2026-34033?
CVE-2026-34033 affects Apache Answer versions up to and including 2.0.0.
What impact does CVE-2026-34033 have on users?
CVE-2026-34033 allows authenticated users to inject arbitrary HTML into emails, which could lead to phishing attacks or other malicious activities.