Unrestricted File Upload Vulnerability in Apache Answer
CVE-2026-33582

6.5MEDIUM

Key Information:

Vendor

Apache
Status
Apache Answer
Vendor
CVE Published:
9 June 2026

What is CVE-2026-33582?

An Unrestricted Upload of File with Dangerous Type vulnerability has been identified in Apache Answer that allows authenticated users to upload crafted TIFF images. This can lead to excessive memory allocation during the image decoding process, which may ultimately crash the server process. To address this security concern, users are strongly advised to upgrade to version 2.0.1, which includes essential fixes.

Affected Version(s)

Apache Answer 0 <= 2.0.0

References

https://lists.apache.org/thread/3sgpx4cwsgpnt66xv3cqvtc8z...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andy Gill, ZephrSec Ltd
.