Live › vulnerability › CVE-2026-64944
Go to dashboardApache Answer through 2.0.2 stores question bodies from its importer as raw HTML without the usual Markdown sanitization. Attacker-supplied HTML in an imported data source is saved and shown to every viewer, including administrators, as stored cross-site scripting.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Apache Answer 2.0.2 or earlier that use the data importer to load content from sources they do not fully control. Installations that never import data, or that only import trusted data, have a much smaller exposure, though the fix is still recommended.
No product ranges from the sources yet.
2.0.2 are affected.2.0.3.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, so attacker-controlled HTML embedded in an imported data source is persisted and rendered to all viewers (including privileged users) as stored XSS.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-64944")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.