Apache Answer CVE-2026-64944

Exploitation requires that the attacker can supply or control the contents of a data source consumed by Apache Answer's question importer, since only that import path stores bodies as raw HTML while skipping the standard Markdown-to-HTML sanitization applied to normal user content. The payload fires when any user - notably a privileged user - renders the imported question, so no victim action beyond viewing is needed, but the attacker must first reach the import workflow, which in Apache Answer is an administrative/trusted function rather than a public submission form. Authentication requirements are not confirmed from available data (no CVSS vector provided), but the import-feature dependency materially limits exploitation to actors who can introduce malicious import data. Affects Apache Answer through 2.0.2; fixed in 2.0.3.

This is a genuinely low-priority issue, consistent with the Apache advisory's 'low' severity rating. Key quantitative signals are absent: no CVSS vector, no EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation probability cannot be numerically bounded. The vulnerability is a stored XSS (CWE-79 class) that occurs only through the data importer, which persists imported question bodies as raw HTML while bypassing the normal Markdown-to-HTML sanitization path. The critical limiting factor is that exploitation depends on an attacker being able to supply or control an imported data source - in Apache Answer the import function is an administrative/privileged operation, not a public submission path - which sharply narrows the realistic attacker population versus a typical unauthenticated web XSS. The mitigating weight is that the rendered payload executes in the browsers of all viewers, including privileged users, so a successful injection can escalate toward session/account compromise of administrators. Net: real but low-likelihood, requiring a privileged or trusted import step; not an emergency patch but worth closing on normal cadence. No conflicting signals exist because almost no automated-risk telemetry was provided - the assessment rests on the vendor description alone.

An attacker able to influence an imported data source embeds malicious HTML (e.g. a <script> or event-handler payload) inside a question body. When the importer ingests it, the raw HTML is stored without sanitization and later rendered to every viewer of that question - including administrators - executing attacker JavaScript in their authenticated browser sessions. No public exploit code was identified at time of analysis, and the attack requires access to the import feature rather than a public posting form.