Cross-site scripting in Apache Answer - CVE-2026-64944
Published: October 22, 2026
Vulnerability identifier: #VU157268
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-64944
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary JavaScript in the browsers of users viewing imported questions, including privileged users.
The vulnerability exists due to improper neutralization of HTML in the Apache Answer importer when importing question bodies without applying the normal Markdown-to-HTML sanitization process. A remote attacker can supply an imported data source containing malicious HTML to persist executable content that runs when users view the imported questions.
Affected software
Apache Answer
How to mitigate CVE-2026-64944
Install security update from vendor's website.
Apache Answer - update to 2.0.3