ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2026-25057

PoC —
CVSS 3.1
9.1 critical
EPSS
<1%p40
Published
()
Modified
Description

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration (courses/ /assignments/upload_config_files). The uploaded zip file entry names are used to create paths to write files to disk without checking these paths. This vulnerability is fixed in 2.9.1.

Vendors
markusproject
Products
markus
Weakness
CWE-23
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news

No ingested article mentions this CVE yet.