CVE-2026-64944: Apache Answer: Stored XSS via unsanitized HTML in imported question content
Apache Answer through 2.0.2 stores imported question HTML unsanitized, enabling stored cross-site scripting.
Enxin Xie reported CVE-2026-64944, a low-severity stored cross-site scripting flaw in Apache Answer through 2.0.2. The importer stores imported question bodies as raw HTML and does not pass them through the normal Markdown-to-HTML sanitization path. Attacker-controlled HTML embedded in imported data can therefore be rendered unsanitized.
- Stored XSS in Apache Answer through 2.0.2, rated low.
- Imported question bodies are saved as raw HTML.
- Import path skips the normal Markdown-to-HTML sanitizer.
- Attacker-controlled HTML in imported data can execute in the page.
- CVEs
- CVE-2026-64944
- Vendors
- Apache Software Foundation
- Products
- Apache Answer
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-64944 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer | — | — |
From the original article
Posted by Enxin Xie on Oct 15 Severity: low Affected versions: - Apache Answer through 2. 0. 2 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.