CVE-2026-25057

Published: Feb 9, 2026Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Exploitability: 2.3 / Impact: 6.0

Source: security-advisories@github.com (Secondary)

Description

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration (courses/<:course_id>/assignments/upload_config_files). The uploaded zip file entry names are used to create paths to write files to disk without checking these paths. This vulnerability is fixed in 2.9.1.

Affected (1)

Products: Markusproject: Markus

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Markusproject Markus	Before 2.9.1

Related CWEs

Relative Path Traversal

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

References (3)

https://github.com/MarkUsProject/Markus/commit/0ca002a1f0071c7a00dbb2ed34fede57323c5dc7

Source: security-advisories@github.com

Patch

https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/MarkUsProject/Markus/security/advisories/GHSA-mccg-p332-252h

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.