CVE-2026-25057 PUBLISHED

Zip Slip in MarkUs config upload allowing RCE

Assigner: GitHub_M
Reserved: 28.01.2026 Published: 09.02.2026 Updated: 09.02.2026

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration (courses/<:course_id>/assignments/upload_config_files). The uploaded zip file entry names are used to create paths to write files to disk without checking these paths. This vulnerability is fixed in 2.9.1.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.1

Product Status

Vendor MarkUsProject
Product Markus
Versions
  • Version < 2.9.1 is affected

References

Problem Types

  • CWE-23: Relative Path Traversal CWE