CVE-2026-25688
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer. Affects versions through 2.0.0. AI-generated response content was rendered in the browser without proper sanitization, allowing malicious scripts to be executed when the content was viewed. Users are recommended to upgrade to version 2.0.1.
Risk Assessment
An attacker can inject a malicious script that executes in the victim's browser, leading to session theft, redirects, or other XSS attacks.
Recommendation
Upgrade Apache Answer to version 2.0.1 or later. Implement Content Security Policy (CSP) and output sanitization.
Other vulnerabilities in Apache Answer
See all- CVE-2026-60053Critical
Apache Answer through version 2.0.1 has insufficient session expiration: administrative API keys remain usable after the owning administrator is demoted or the account is marked inactive, suspended, or deleted, allowing continued access until the keys are explicitly removed.
- CVE-2026-60023High
Apache Answer through version 2.0.1 has a vulnerability exposing sensitive information: deleted or pending answers can be retrieved by unauthorized users through the single-answer read path when the parent question remains visible.
- CVE-2026-50749Medium
Apache Answer through version 2.0.1 has an improper authorization vulnerability: any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation.
- CVE-2026-48912Medium
Apache Answer through version 2.0.1 has an improper input validation vulnerability: a missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs.
- CVE-2026-48911High
Apache Answer through version 2.0.1 has an insufficient verification of data authenticity vulnerability: a missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link.
- CVE-2026-48834High
Apache Answer through version 2.0.1 has an improper handling of length parameter inconsistency vulnerability: unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing.
- CVE-2026-25700High
CVE-2026-25700 describes an improper restriction of security token assignment vulnerability in Apache Answer up to version 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired.
- CVE-2026-34905Medium
Apache Answer up to version 2.0.0 did not enforce access restrictions on direct API endpoints for unlisted questions. Authenticated users could discover and view such questions, answers, comments, and revision history.
- CVE-2026-34033Medium
Apache Answer through version 2.0.0 has an XSS vulnerability because user-supplied content is included in notification emails without proper escaping. An authenticated user can inject arbitrary HTML into emails sent to other users.
- CVE-2026-34031Medium
In Apache Answer up to version 2.0.0, there is an unrestricted file upload vulnerability with dangerous type. The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images.
Original NVD description (English source)
Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. AI-generated response content was rendered in the browser without proper sanitization, allowing malicious scripts to be executed when the content was viewed. Users are recommended to upgrade to version 2.0.1, which fixes the issue.