This vulnerability allows an attacker to embed malicious HTML directly into imported question bodies because the importer bypasses the normal Markdown‑to‑HTML sanitization. The stored HTML is persisted and rendered to all viewers, including privileged users, giving the attacker the ability to run arbitrary scripts in their browsers. This can lead to theft of session cookies, credential leakage, or other session‑based attacks. The vulnerability is an instance of Improper Neutralization of Input During Web Page Generation.

Products affected are Apache Answer versions up to and including 2.0.2, provided by the Apache Software Foundation. Any installation running these versions and that uses imported question data is at risk.

The risk is moderate with a CVSS score of 5.4 and an EPSS score of < 1%, and it is not listed in the CISA KEV catalog. The flaw is a stored XSS that works on any user who can view the imported content, including administrators. The likely attack vector is an import of attacker‑controlled content; an attacker only needs to supply malicious HTML during import and then obtain user views of the affected question.