CVE-2026-64944: Apache Answer: Stored XSS via unsanitized HTML in imported question content
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, so attacker-controlled HTML embedded in an imported data source is persisted and rendered to all viewers (including privileged users) as stored XSS.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Answerto a version that resolves this vulnerability.Fixed in 2.0.3
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Apache Answer installations through version 2.0.2 are affected if they import question content from a data source that can contain attacker-controlled HTML. Any user who views an imported malicious question body, including privileged users, can be exposed to the stored XSS.
What does an attacker need to exploit it?
The attacker needs their HTML payload to be embedded in question content that is imported into Apache Answer. The vulnerable importer persists that content as raw HTML rather than sending it through the normal Markdown-to-HTML sanitization path.
How can the issue be remediated?
Upgrade Apache Answer to version 2.0.3, which fixes the issue.
How can I identify potentially affected content?
Review question bodies imported while running an affected version for raw HTML, particularly content originating from untrusted or attacker-influenced data sources. Such HTML may have been stored and rendered without the normal sanitization process.