VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Jun 9, 2026· Updated Jun 11, 2026

CVE-2026-34033

CVE-2026-34033

Description

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.0.

User-supplied content was included in notification emails without proper escaping, allowing authenticated users to inject arbitrary HTML into emails sent to other users. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/apache/incubator-answerGo
< 1.7.2-0.20260509080709-d1a4092c61cc1.7.2-0.20260509080709-d1a4092c61cc

Affected products

2
  • Apache/Answer2 versions
    cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*range: <2.0.1
    • (no CPE)range: <=2.0.0

Patches

Vulnerability mechanics

References

6

News mentions

1