CVE-2026-64944: stored XSS in Apache Answer via imported questions

Advisory CVE-2026-64944, published on October 16, 2026 in an open source security mailing list feed, describes a stored cross-site scripting vulnerability in Apache Answer. According to the text, the importer stores imported question bodies as raw HTML without passing through the normal Markdown-to-HTML sanitization step. As a result, HTML controlled by an attacker inside imported data can be stored and shown to other people. The severity is rated low and all versions up to 2.0.2 are affected. The available excerpt does not describe the full exploitation scenario. This is an automatic translation, so check the original message on the oss-sec list before making decisions. Rota Nacional does not run or patch Apache Answer, and this advisory does not describe any platform feature. If your organization uses this software, verify the installed version, look in the project release notes for a fixed version, review recently imported questions for unexpected HTML or scripts, and limit imports to trusted sources. If you use AI to summarize or study this advisory, do not paste internal forum content that contains personal data. The platform detects data such as CPF, e-mail and phone before any model runs and applies the organization's policy: placeholders, removal or block.