CVE-2026-34033: Apache Answer XSS in notification emails

CVE-2026-34033 · Severity: medium · CVSS 5.4 · Published 2026-06-09

Apache Answer, an open-source Q&A platform, is vulnerable to a security flaw where user-provided content is not properly cleaned before being included in notification emails. This allows an attacker with a standard user account to inject malicious code or formatting into emails sent to other users. Such an exploit could be used for phishing or to mislead users, potentially damaging the organization's reputation or leading to further account compromise.

Technologies: Apache Software Foundation Answer, github.com/apache/answer (Go), github.com/apache/incubator-answer (Go). Vendors: Apache Software Foundation, Go.

Quick answers

Is CVE-2026-34033 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34033 being exploited in the wild.
How severe is CVE-2026-34033?
Medium severity, with a CVSS score of 5.4, published 9 June 2026.
Which products and versions are affected?
Apache Software Foundation Answer through 2.0.0; github.com/apache/answer (Go) SEMVER:introduced=0,fixed=1.7.2-0.20260509080709-d1a4092c61cc; github.com/apache/incubator-answer (Go) < 1.7.2-0.20260509080709-d1a4092c61cc, SEMVER:introduced=0,fixed=1.7.2-0.20260509080709-d1a4092c61cc.
Is there a fix for CVE-2026-34033?
Yes. github.com/apache/answer (Go): upgrade to 1.7.2-0.20260509080709-d1a4092c61cc or later; github.com/apache/incubator-answer (Go): upgrade to 1.7.2-0.20260509080709-d1a4092c61cc or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34033 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-34033?
Check whether you run Apache Software Foundation Answer, github.com/apache/answer (Go) or github.com/apache/incubator-answer (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/apache/answer (Go): upgrade to 1.7.2-0.20260509080709-d1a4092c61cc or later
    go get github.com/apache/answer@v1.7.2-0.20260509080709-d1a4092c61cc
  • github.com/apache/incubator-answer (Go): upgrade to 1.7.2-0.20260509080709-d1a4092c61cc or later
    go get github.com/apache/incubator-answer@v1.7.2-0.20260509080709-d1a4092c61cc

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in Apache Answer versions up to and including 2.0.0. The root cause is the improper neutralization of script-related HTML tags (CWE-80) within the email notification component. An authenticated attacker can provide malicious input that is subsequently included in notification emails sent to other users without proper HTML escaping. When a recipient views the email in a client that renders HTML, the injected code may execute or alter the message's appearance. This vulnerability is fixed in version 2.0.1 by implementing proper escaping of dynamic content in email templates.

Affected products

  • Apache Answer through 2.0.0

Identifiers

  • CVE-2026-34033
  • GHSA-6qwm-5fm9-cvjx
  • GO-2026-6151

Timeline

  • 2026-05-29: patched: Version 2.0.1 released
  • 2026-06-09: disclosed: Public advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.