CVEvulnerability

CVE-2026-25057

9.1 CRITICAL Published 2026-02-09 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2026-02-09
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses: CWE-23

Description

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration (courses/<:course_id>/assignments/upload_config_files). The uploaded zip file entry names are used to create paths to write files to disk without checking these paths. This vulnerability is fixed in 2.9.1.

Affected configurations

• markusproject markus (< 2.9.1)

Weakness · CWE (1)

CWE-23 Relative Path Traversal weakness

References

https://github.com/MarkUsProject/Markus/commit/0ca002a1f0071c7a00dbb2ed34fede57323c5dc7 Patch
https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1 Product, Release Notes
https://github.com/MarkUsProject/Markus/security/advisories/GHSA-mccg-p332-252h Vendor Advisory

CVE-2026-25057

Description

Affected configurations

Related

Weakness · CWE (1)

References