GHSA-v553-g2w6-295p

Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-33582

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/apache/incubator-answer	< 1.7.2-0.20260325113131-cfc3e54f30cc	1.7.2-0.20260325113131-cfc3e54f30cc

Details

As written in the advisory (Markdown source, shown as plain text).

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. A crafted TIFF image could trigger excessive memory allocation during image decoding, allowing an authenticated user to cause the server process to crash. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-33582 advisory
https://github.com/apache/answer/commit/cfc3e54f30cc5e01afb7110ecc1da9152d0a3a41 web
https://github.com/apache/answer package
https://github.com/apache/answer/releases/tag/v2.0.1 web
https://lists.apache.org/thread/3sgpx4cwsgpnt66xv3cqvtc8z4st1kbq web
http://www.openwall.com/lists/oss-security/2026/06/09/5 web