CVE-2026-64944

MediumCVSS 5.4/10Last modified Nov 3, 2026

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.2.

The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, so attacker-controlled HTML embedded in an imported data source is persisted and rendered to all viewers (including privileged users) as stored XSS.

Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Answer	<= 2.0.2

References

Timeline

Published: Oct 19, 2026
Last modified: Nov 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-649457.5A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show ope CVE-2026-649467.4A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling sessio CVE-2026-649477.5A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitra CVE-2026-649487.1Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onward CVE-2026-649498.6Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandor CVE-2026-64957.1The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to CVE-2026-649508.4Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing CVE-2026-649513.5A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may cr CVE-2026-649526.5The hunt_delete() VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually CVE-2026-649548.2Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLE CVE-2026-649556.1When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary ex CVE-2026-649587.5An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a messag