Vulnerability · Published Jun 9, 2026 · Assigned by apache
CVE-2026-34031Apache Answer: The custom avatar was not properly validated
Medium 6.5
In plain English
A medium-severity unrestricted file upload in Apache Answer from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images, which could expose users to unintended external requests and tracking by third-party servers. Users are recommended to upgrade to version 2.0.1, which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/apache/answer | 1.7.2-0.20260511040518-11091244f64e | GO-2026-6154 |
| Go | github.com/apache/incubator-answer | 1.7.2-0.20260511040518-11091244f64e | GHSA-x4f6-mqg6-28xx |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Answer | 0 – through 2.0.0 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N