CVE-2026-64944: Apache Answer XSS Vulnerability

CVE-2026-64944 Overview

CVE-2026-64944 is a stored cross-site scripting (XSS) vulnerability in Apache Answer, an open-source question-and-answer platform. The flaw affects all versions through 2.0.2. The importer component stores imported question bodies as raw HTML and skips the normal Markdown-to-HTML sanitization path. Attacker-controlled HTML embedded in an imported data source is persisted to the database and rendered to every viewer, including administrators and other privileged users. The Apache Software Foundation released version 2.0.3 to address the issue.

Critical Impact
Attackers can inject persistent JavaScript that executes in the browser of any user who views an imported question, enabling session theft, account takeover, and privileged action abuse.

Affected Products

Apache Answer versions through 2.0.2
Apache Answer importer component (question body handling)
Deployments ingesting third-party or user-supplied import data

Discovery Timeline

2026-10-19 - CVE CVE-2026-64944 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-64944

Vulnerability Analysis

The vulnerability is a stored XSS flaw classified under [CWE-79]. Apache Answer normally renders user content by converting Markdown input into HTML through a sanitization pipeline that strips dangerous tags, attributes, and event handlers. The importer component bypasses this pipeline. It accepts question bodies from external data sources and writes them to the database as raw HTML without filtering.

When any user later views an imported question, the server returns the stored HTML and the browser executes any embedded <script> tags, inline event handlers, or malicious attributes. Because the payload fires in authenticated sessions, an attacker can harvest session cookies, perform actions on behalf of moderators, or pivot into administrator accounts that view the imported content.

Root Cause

The root cause is inconsistent input handling across content ingestion paths. The standard user-facing submission flow routes content through Markdown parsing and HTML sanitization. The import path treats the question body as pre-rendered HTML and persists it verbatim. This divergence creates an unsanitized trust boundary that any party controlling an import file can exploit.

Attack Vector

Exploitation requires the ability to supply or influence an import data source consumed by an Apache Answer instance. An attacker crafts an import file that contains a question body with embedded HTML payloads such as <script> elements or event handlers. After the import completes, the malicious markup is stored and served to every user who opens the affected question thread. Technical details are available in the Apache Thread Discussion and the OpenWall OSS-Security Update.

Detection Methods for CVE-2026-64944

Indicators of Compromise

Question records containing <script>, onerror, onload, or javascript: strings in the body column of the Apache Answer database.
Import audit logs referencing data sources from untrusted or unexpected origins.
Outbound requests from user browsers to attacker-controlled domains after viewing imported threads.

Detection Strategies

Query the question table for HTML tags that should not survive sanitization, such as <script, <iframe, or on\w+= attribute patterns.
Correlate recent import operations with new or modified question records and review the raw HTML content.
Monitor web application firewall logs for outbound XSS probes or callbacks to known credential-collection endpoints.

Monitoring Recommendations

Enable verbose logging on the importer workflow and alert on any import executed by non-administrator accounts.
Deploy Content Security Policy (CSP) reporting to capture script execution violations originating from Apache Answer pages.
Review browser telemetry and endpoint identification data for anomalous script activity following access to Q&A threads.

How to Mitigate CVE-2026-64944

Immediate Actions Required

Upgrade Apache Answer to version 2.0.3, which routes imported question bodies through the standard sanitization path.
Audit all imports performed on versions through 2.0.2 and purge or re-sanitize any question bodies containing executable HTML.
Rotate session tokens and administrative credentials if evidence of payload execution is found.

Patch Information

The Apache Answer project released version 2.0.3 as the fix for CVE-2026-64944. The patch forces imported question bodies through the Markdown-to-HTML sanitization pipeline used for standard submissions. Operators should apply the upgrade per the project release notes and verify the running version after deployment.

Workarounds

Restrict importer access to a small set of trusted administrators until the upgrade is applied.
Validate and sanitize import files out-of-band, stripping HTML tags before ingestion into Apache Answer.
Deploy a strict Content Security Policy that forbids inline scripts and limits script sources to trusted origins.

bash

# Example strict CSP header to block inline script execution
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'