CVE-2026-64944 Apache Answer: Stored XSS via unsanitized HTML in imported question content

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, ...

CVE-2026-64944

Versions of Apache Answer through 2.0.2 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is that the importer stores question bodies from imported data sources as raw HTML, bypassing the standard Markdown-to-HTML sanitization path. Consequently, attacker-controlled HTML ...