What is the CVSS score of CVE-2026-34033?

CVE-2026-34033 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apache Answer are affected by CVE-2026-34033?

Apache Answer email notification system (all versions through 2.0.0) contains a CRITICAL HTML injection vulnerability allowing authenticated users to embed malicious markup into notification emails…. A patch is available.

How to fix or mitigate CVE-2026-34033?

Within 24 hours: Audit Apache Answer deployment version and review notification system logs for suspicious HTML content patterns. Within 7 days: Implement text-only rendering for notification emails or deploy strict HTML sanitization on all user-generated notification content. Within 30 days: No vendor-released patch identified at time of analysis; establish monitoring for Apache Answer security updates and develop upgrade plan for when patched version becomes available.

Apache Answer CVE-2026-34033

EUVD-2026-35371 MEDIUM

Basic XSS (CWE-80)

2026-06-09

GHSA-6qwm-5fm9-cvjx

XSS Apache Answer

5.4

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jun 09, 2026 - 17:22 NVD

5.4 (MEDIUM)

Analysis Generated

Jun 09, 2026 - 08:18 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical HTML Injection in Apache Answer Email Notifications - CVE-2026-34033 Jun 09, 2026

AnalysisAI

HTML content injection in Apache Answer's email notification system allows authenticated users to embed arbitrary HTML markup into notification emails delivered to other platform users. All versions through 2.0.0 are affected. Because no CVSS vector was published at time of analysis, authentication requirements are confirmed from the description rather than from a CVSS PR component - an attacker must have a valid platform account to submit the content that triggers the malicious notification. No public exploit code and no CISA KEV listing have been identified.

Technical ContextAI

Apache Answer is an open-source Q&A platform (answer.apache.org) designed for community forums, help centers, and knowledge-management use cases. The root cause maps to CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page - Basic XSS): user-supplied content (such as answers, comments, or other contributions) is embedded into outbound notification emails without HTML-encoding. Email clients that render HTML in message bodies will interpret injected tags, enabling visual content manipulation, hyperlink injection, and - depending on the email client's sandboxing - potentially more sophisticated phishing payloads. The attack surface is the server-side email templating layer, not a browser DOM, which limits classic JavaScript execution but still enables significant social-engineering risk through HTML rendering.

RemediationAI

Upgrade to Apache Answer 2.0.1, which the vendor confirms resolves this issue by applying proper HTML escaping to user-supplied content before it is embedded in notification email templates. The fix is confirmed by the Apache security advisory at https://seclists.org/oss-sec/2026/q2/849. If an immediate upgrade is not feasible, a compensating control is to configure your mail gateway or email security product to strip or neutralize HTML tags from outbound application-generated emails - note this may alter legitimate rich-text formatting in notifications. A second partial mitigation is to disable email notifications entirely in the Apache Answer admin panel if the feature is not operationally required, eliminating the delivery path for injected content. Neither workaround substitutes for patching to 2.0.1.