What is the CVSS score of CVE-2026-34031?

CVE-2026-34031 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apache Answer are affected by CVE-2026-34031?

Apache Answer through version 2.0.0 contains a URL validation vulnerability in avatar configuration that allows authenticated users to force the platform to request images from attacker-controlled…. A patch is available.

How to fix or mitigate CVE-2026-34031?

Within 24 hours: Identify all Apache Answer instances running version 2.0.0 or earlier; assess authentication scope and profile visibility settings. Within 7 days: Implement immediate controls by restricting avatar URLs to internal/whitelisted domains only or disabling external avatar functionality entirely via application configuration. Within 30 days: Establish monitoring process for Apache Answer project releases; commit to applying vendor patch immediately upon availability.

Apache Answer CVE-2026-34031

EUVD-2026-35370 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-09

GHSA-x4f6-mqg6-28xx

File Upload Apache Answer

6.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jun 09, 2026 - 16:22 NVD

6.5 (MEDIUM)

Analysis Generated

Jun 09, 2026 - 08:17 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical SSRF in Apache Answer 2.0.0 - CVE-2026-34031 Jun 09, 2026

AnalysisAI

Insufficient validation of user-supplied avatar image URLs in Apache Answer through 2.0.0 allows authenticated users to set arbitrary external URLs as profile images, causing the platform or clients to issue outbound HTTP requests to attacker-controlled servers on page load. This exposes user IP addresses, HTTP headers, and browsing activity to third-party infrastructure whenever affected profiles are viewed. Rated moderate severity by Apache; no public exploit identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

Apache Answer is an open-source Go-based Q&A platform (~15.5k GitHub stars) used for community forums, help centers, and knowledge management. The vulnerability exists in the custom avatar feature, where the server accepts user-supplied image URLs without sufficiently restricting the external hosts or schemes those URLs reference. Although the CVE classification references CWE-434 (Unrestricted Upload of File with Dangerous Type) in its title, the described behavior - embedding arbitrary external URLs that trigger outbound HTTP requests - more precisely aligns with an input validation failure (CWE-20) or a server-side request forgery vector (CWE-918). The root cause is the absence of an allowlist or domain restriction on the avatar URL input field. No CPE string was provided in the available data; the affected component is the profile/avatar subsystem of Apache Answer through version 2.0.0.

RemediationAI

Upgrade Apache Answer to version 2.0.1, which is the vendor-confirmed fix per the oss-security advisory (https://seclists.org/oss-sec/2026/q2/850) and the Apache Answer project site (https://answer.apache.org). If immediate upgrade is not feasible, a compensating control is to implement a domain allowlist at the web application firewall or reverse proxy layer, blocking outbound HTTP requests initiated by user-supplied avatar URLs to non-approved external hosts - note this may break legitimate use of third-party avatar hosting services. Alternatively, the platform could be configured to proxy and cache avatar images server-side through a trusted image-fetching service, stripping direct user-to-attacker-server connections, though this adds infrastructure complexity. No other vendor-confirmed workarounds were identified in the available data.