Cross-Site Scripting Vulnerability in Apache Answer Affects User-Generated Content

CVE-2026-64944

What is CVE-2026-64944?

This vulnerability arises from improper handling of user input during web page generation in Apache Answer. Specifically, the product stores imported question bodies as raw HTML, bypassing the essential Markdown-to-HTML sanitization. As a result, it allows attacker-controlled HTML to be embedded in imported data sources. This persisted malicious content can later be rendered to all users, including those with elevated privileges, leading to potential security breaches through stored Cross-Site Scripting (XSS) attacks. Users are strongly urged to upgrade to version 2.0.3 to resolve this vulnerability and protect their applications.

References