CVE-2026-85684

Published: Sep 4, 2026Modified: Sep 8, 2026

8.8

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existing files on the system.

Related CWEs

CWE-73

External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

References (5)

https://github.com/datalab-to/marker

Source: disclosure@vulncheck.com

https://github.com/datalab-to/marker/blob/v2.0.0/marker/scripts/server.py

Source: disclosure@vulncheck.com

https://github.com/datalab-to/marker/issues/1047

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/marker-through-2.0.0-path-traversal-via-upload-filename

Source: disclosure@vulncheck.com

https://github.com/datalab-to/marker/issues/1047

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.