CVE-2026-34031

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-34031
Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images, which could expose users to unintended external requests and tracking by third-party servers. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/rwtxy39t54to9kv3dqtbjsbdpyk4jkd2 Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/06/09/4 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*
History

23 Jul 2026, 08:10

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de carga irrestricta de archivos de tipo peligroso en Apache Answer. Este problema afecta a Apache Answer: hasta la versión 2.0.0. El servidor no validaba suficientemente las URL de imágenes proporcionadas por el usuario, permitiendo que contenido externo arbitrario se incrustara como imágenes de perfil, lo que podría exponer a los usuarios a solicitudes externas no intencionadas y al seguimiento por parte de servidores de terceros. Se recomienda a los usuarios actualizar a la versión 2.0.1, que corrige el problema.

10 Jun 2026, 13:28

Type Values Removed Values Added
References () https://lists.apache.org/thread/rwtxy39t54to9kv3dqtbjsbdpyk4jkd2 - () https://lists.apache.org/thread/rwtxy39t54to9kv3dqtbjsbdpyk4jkd2 - Mailing List, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2026/06/09/4 - () http://www.openwall.com/lists/oss-security/2026/06/09/4 - Mailing List, Third Party Advisory
First Time Apache
Apache answer
CPE cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*

09 Jun 2026, 16:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

09 Jun 2026, 10:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/06/09/4 -

09 Jun 2026, 09:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-09 09:16

Updated : 2026-07-23 08:10

NVD link : CVE-2026-34031

Mitre link : CVE-2026-34031

CVE.ORG link : CVE-2026-34031

JSON object : View

Products Affected

apache

  • answer
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type