---
id: CVE-2026-34033
aliases:
  - GHSA-6qwm-5fm9-cvjx
title: Apache Answer vulnerable to Cross-site Scripting
summary: Apache Answer vulnerable to Cross-site Scripting
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
vendor: apache
product: github.com/apache/incubator-answer
ecosystem: go
affected:
  - github.com/apache/incubator-answer < 1.7.2-0.20260509080709-d1a4092c61cc
patched:
  - github.com/apache/incubator-answer 1.7.2-0.20260509080709-d1a4092c61cc
published: '2026-06-09'
updated: '2026-07-31'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-6qwm-5fm9-cvjx'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-34033'
  - url: >-
      https://github.com/apache/answer/commit/d1a4092c61ccd41988d1033fce47eb513adb433e
  - url: 'https://github.com/apache/answer'
  - url: 'https://github.com/apache/answer/releases/tag/v2.0.1'
  - url: 'https://lists.apache.org/thread/wrfd9blbfotfg479jr8vlwfx6pwr9sgj'
  - url: 'http://www.openwall.com/lists/oss-security/2026/06/09/3'
tags:
  - osv
  - go
epss: 0.0052
epssPercentile: 0.41636
ingestedAt: '2026-07-31T19:10:07.652Z'
---

## Overview

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.0.

User-supplied content was included in notification emails without proper escaping, allowing authenticated users to inject arbitrary HTML into emails sent to other users.
Users are recommended to upgrade to version 2.0.1, which fixes the issue.

## Affected packages

- `github.com/apache/incubator-answer < 1.7.2-0.20260509080709-d1a4092c61cc`

## Remediation

Upgrade to a patched release:

- `github.com/apache/incubator-answer 1.7.2-0.20260509080709-d1a4092c61cc`