CVE-2026-64944: Apache Answer: Stored XSS via unsanitized HTML in imported question content

Q: Who is exposed to this vulnerability?

Apache Answer installations through version 2.0.2 are affected if they import question content from a data source that can contain attacker-controlled HTML. Any user who views an imported malicious question body, including privileged users, can be exposed to the stored XSS.

Q: What does an attacker need to exploit it?

The attacker needs their HTML payload to be embedded in question content that is imported into Apache Answer. The vulnerable importer persists that content as raw HTML rather than sending it through the normal Markdown-to-HTML sanitization path.

Q: How can the issue be remediated?

Upgrade Apache Answer to version 2.0.3, which fixes the issue.

Q: How can I identify potentially affected content?

Review question bodies imported while running an affected version for raw HTML, particularly content originating from untrusted or attacker-influenced data sources. Such HTML may have been stored and rendered without the normal sanitization process.

Published Oct 16, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.2.

The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, so attacker-controlled HTML embedded in an imported data source is persisted and rendered to all viewers (including privileged users) as stored XSS.

Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Affected Software

1 affected component

Apache Answer<=2.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Answer to a version that resolves this vulnerability.
Fixed in 2.0.3

Event History

Oct 19, 2026

CVE Published

via MITRE·09:26 AM

Data Sourced

via MITRE·09:26 AM

DescriptionWeakness

Data Sourced

via NVD·10:16 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

Apache Answer installations through version 2.0.2 are affected if they import question content from a data source that can contain attacker-controlled HTML. Any user who views an imported malicious question body, including privileged users, can be exposed to the stored XSS.

What does an attacker need to exploit it?

The attacker needs their HTML payload to be embedded in question content that is imported into Apache Answer. The vulnerable importer persists that content as raw HTML rather than sending it through the normal Markdown-to-HTML sanitization path.

How can the issue be remediated?

Upgrade Apache Answer to version 2.0.3, which fixes the issue.

How can I identify potentially affected content?

Review question bodies imported while running an affected version for raw HTML, particularly content originating from untrusted or attacker-influenced data sources. Such HTML may have been stored and rendered without the normal sanitization process.

CVE-2026-64944: Apache Answer: Stored XSS via unsanitized HTML in imported question content

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit it?

How can the issue be remediated?

How can I identify potentially affected content?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit it?

How can the issue be remediated?

How can I identify potentially affected content?