CVE-2026-64944

Name of the Vulnerable Software and Affected Versions Apache Answer versions prior to 2.0.3

Description An issue exists where the importer stores imported question bodies as raw HTML instead of using the standard Markdown-to-HTML sanitization path. This allows attacker-controlled HTML within an imported data source to be persisted and rendered to all viewers, including privileged users, resulting in stored Cross-site Scripting (XSS), which is a flaw where malicious scripts are injected into trusted websites.

Recommendations Upgrade to version 2.0.3.