As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-64944: Apache Answer: Stored XSS via unsanitized HTML in imported question content
Apache Answer through version 2.0.2 contains a stored cross-site scripting (XSS) vulnerability in its question importer. The flaw arises because imported question content is stored as raw HTML without passing through the standard Markdown-to-HTML sanitization process, allowing attackers to inject malicious scripts.
Why it matters: Organizations deploying Apache Answer and using its import feature should apply patches to prevent attackers from injecting stored XSS payloads that could compromise other users accessing affected questions.
- Source published
- First seen by Cybersecurity Tracker