GitHub Advisoryadvisory · Go

GHSA-x4f6-mqg6-28xx Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability

MEDIUM Published 2026-06-09 Modified 2026-07-31 Official page ↗
Aliases
CVE-2026-34031
Ecosystem
Go
Packages
github.com/apache/incubator-answer
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-434
Reviewed
2026-07-31

Affected packages

• Go github.com/apache/incubator-answer: < 1.7.2-0.20260511040518-11091244f64e → fixed in 1.7.2-0.20260511040518-11091244f64e

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images, which could expose users to unintended external requests and tracking by third-party servers. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2026-34031 Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References