CVE-2026-27807

Published: Mar 6, 2026Modified: Jun 17, 2026

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.2 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows course instructors to upload YAML files to create/update various entities (e.g., assignment settings). These YAML files are parsed with aliases enabled. This issue has been patched in version 2.9.4.

Affected (1)

Products: Markusproject: Markus

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Markusproject Markus	Before 2.9.4

Related CWEs

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

References (2)

https://github.com/MarkUsProject/Markus/releases/tag/v2.9.4

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/MarkUsProject/Markus/security/advisories/GHSA-m9rx-85mx-q9h6

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.