Apache Answer Stored XSS in Imports Bypasses Markdown Sanitization Through v2.0.2

Apache Answer installations running versions through 2.0.2 are exposed to a stored cross-site scripting flaw. Environments that utilise data import features face the greatest risk, as the application fails to sanitise specific input streams. Security teams should assess whether their instances process external question data, as this pathway bypasses normal security controls.

Root cause

The vulnerability stems from improper neutralisation of input during web page generation. According to the advisory from the oss-security mailing list, the importer stores question bodies as raw HTML. This data does not pass through the standard Markdown-to-HTML sanitisation path that typically strips dangerous scripts. Consequently, attacker-controlled HTML embedded in imported data persists in the database and renders directly in the browser.

Attack path

An adversary would need to inject malicious HTML into the source data used for importing questions. When a user imports this content, the application saves the raw HTML without filtering. Any user who subsequently views the affected question executes the embedded script in their browser context. This stored nature means the payload remains active until manually removed or patched.

Affected versions

• Apache Answer through version 2.0.2

Mitigation

• Review import logs for unusual HTML structures in question bodies.
• Isolate instances that process untrusted imported data.
• Monitor for unexpected script execution in user sessions.
• No fix has been confirmed yet.

Signals worth monitoring

Teams usually detect stored cross-site scripting by reviewing web server logs for requests containing script tags or event handlers within POST data. Check whether application firewalls flagged attempts to inject HTML into import endpoints. Look for anomalous JavaScript execution in browser developer consoles during routine question browsing. Investigate any sudden changes in network traffic originating from web pages that should only display static text. Containment often involves temporarily disabling import features or restricting access to affected question categories until a permanent solution is available.

Background: Cross-site scripting (XSS)

Prevent cross-site scripting by encoding data before output, validating input strictly, and setting restrictive Content Security Policy headers. Use modern frameworks that auto-escape content. Regularly review legacy code for raw HTML insertion. This checklist ensures your application handles untrusted data safely without relying solely on perimeter security tools.

Read the full guide: Cross-Site Scripting Prevention Checklist for Secure Web Applications

What to do and how to stay safe: Apache Answer

• Audit import procedures to ensure all incoming data undergoes strict sanitisation.
• Implement output encoding on all user-facing pages displaying imported content.
• Monitor browser console logs for unhandled script errors or unexpected executions.
• Once the vendor provides an update, apply it immediately to vulnerable instances.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Apache Answer versions are affected by CVE-2026-64944?

All versions through 2.0.2 are affected by this stored cross-site scripting vulnerability.

What is the severity rating for this CVE?

The advisory rates the severity as low.

How does the vulnerability occur?

It occurs because imported question bodies are stored as raw HTML without sanitisation.