CVE-2026-34031

MediumCVSS 6.5/10Last modified Jul 23, 2026

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.0.

The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images, which could expose users to unintended external requests and tracking by third-party servers. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Answer	<= 2.0.0

References

https://lists.apache.org/thread/rwtxy39t54to9kv3dqtbjsbdpyk4jkd2Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/06/09/4Mailing List, Third Party Advisory

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-340325.3Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. CVE-2026-340335.4Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache Answer. This issue affects Apache Ans CVE-2026-340348.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the sentinel_to CVE-2026-340358.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, log drain secre CVE-2026-340366.5Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions 22.0.4 and prior,CVE-2026-340379.9Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() L CVE-2026-340389.9Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, an authenticate CVE-2026-34048.1A flaw has been found in thinkgem JeeSite up to 5.15.1. Impacted is an unknown function of the file /com/jeesite/common/shiro/cas/CasOutHand CVE-2026-340407.8Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to byp CVE-2026-340419.8act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::s CVE-2026-340428.2act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to c CVE-2026-340437.5Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Ser