https://seclists.org/oss-sec/2026/q4/198: CVE-2026-64944: Apache Answer: Stod XSS via unsanitized HTML in imported question content
Published Oct 16, 2026
·Updated
Affected Software
1 affected component
Apache Answer<=2.0.2
Instances of Apache Answer through 2.0.2 are exposed when they import question content from a data source containing attacker-controlled HTML. The imported HTML is persisted and rendered to all viewers, including privileged users.
An attacker needs to embed malicious HTML in question body content within a data source that is subsequently imported into Apache Answer. The vulnerable importer stores that content as raw HTML rather than sending it through the normal sanitization path.
The issue is tied to importing question content; the provided information does not indicate that ordinary question creation follows the vulnerable path. A deployment is affected if it uses the importer to ingest question bodies containing untrusted HTML.
Upgrade Apache Answer to version 2.0.3, which fixes the issue. If upgrading is not immediately possible, avoid importing question content from untrusted sources or sources that may contain attacker-controlled HTML.
Review imported question bodies for raw or unexpected HTML, particularly content imported from untrusted sources. Because the HTML is persisted, previously imported malicious content may render whenever viewers open the affected questions.