GHSA-x4f6-mqg6-28xx

Source

https://github.com/advisories/GHSA-x4f6-mqg6-28xx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-x4f6-mqg6-28xx/GHSA-x4f6-mqg6-28xx.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-x4f6-mqg6-28xx

Aliases

Published

2026-06-09T09:32:07Z

Modified

2026-08-18T15:11:02Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability

Details

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.0.

The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images, which could expose users to unintended external requests and tracking by third-party servers. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Database specific

{
    "cwe_ids": [
        "CWE-434"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-31T15:45:20Z",
    "nvd_published_at": "2026-06-09T09:16:29Z",
    "severity": "MODERATE"
}

References

Affected packages

Go / github.com/apache/incubator-answer

Package

Name: github.com/apache/incubator-answer; View open source insights on deps.dev
Purl: pkg:golang/github.com/apache/incubator-answer

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.7.2-0.20260511040518-11091244f64e

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-x4f6-mqg6-28xx/GHSA-x4f6-mqg6-28xx.json"