CVE-2026-34031
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
In Apache Answer up to version 2.0.0, there is an unrestricted file upload vulnerability with dangerous type. The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images.
Risk Assessment
An attacker could exploit this vulnerability to expose users to unintended external requests and tracking by third-party servers, potentially leading to data leakage or privacy breaches.
Recommendation
It is recommended to immediately upgrade Apache Answer to version 2.0.1, which fixes this issue.
Other vulnerabilities in Apache Answer
See all- CVE-2026-60053Critical
Apache Answer through version 2.0.1 has insufficient session expiration: administrative API keys remain usable after the owning administrator is demoted or the account is marked inactive, suspended, or deleted, allowing continued access until the keys are explicitly removed.
- CVE-2026-60023High
Apache Answer through version 2.0.1 has a vulnerability exposing sensitive information: deleted or pending answers can be retrieved by unauthorized users through the single-answer read path when the parent question remains visible.
- CVE-2026-50749Medium
Apache Answer through version 2.0.1 has an improper authorization vulnerability: any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation.
- CVE-2026-48912Medium
Apache Answer through version 2.0.1 has an improper input validation vulnerability: a missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs.
- CVE-2026-48911High
Apache Answer through version 2.0.1 has an insufficient verification of data authenticity vulnerability: a missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link.
- CVE-2026-48834High
Apache Answer through version 2.0.1 has an improper handling of length parameter inconsistency vulnerability: unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing.
- CVE-2026-25700High
CVE-2026-25700 describes an improper restriction of security token assignment vulnerability in Apache Answer up to version 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired.
- CVE-2026-34905Medium
Apache Answer up to version 2.0.0 did not enforce access restrictions on direct API endpoints for unlisted questions. Authenticated users could discover and view such questions, answers, comments, and revision history.
- CVE-2026-34033Medium
Apache Answer through version 2.0.0 has an XSS vulnerability because user-supplied content is included in notification emails without proper escaping. An authenticated user can inject arbitrary HTML into emails sent to other users.
- CVE-2026-33582Medium
Apache Answer up to version 2.0.0 has an unrestricted file upload vulnerability. A crafted TIFF image can trigger excessive memory allocation during decoding, causing a server crash. Authentication is required.
Original NVD description (English source)
Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images, which could expose users to unintended external requests and tracking by third-party servers. Users are recommended to upgrade to version 2.0.1, which fixes the issue.