CVE-2026-24479

CRITICAL

HUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCE

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-24479 has a selected CVSS score of 9.3 (critical); EIP currently links 2 catalogued exploits.

Description

HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Attackers can craft a malicious ZIP file containing files with path traversal sequences (e.g., ../../shell.php). When extracted by the server, this allows writing files to arbitrary locations in the web root, leading to Remote Code Execution (RCE). Version 26.01.24 contains a fix for the issue.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
2

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 27, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

hustoj

Browse zhblue / hustoj
CVE List< 26.01.24affected

Proofs of concept

2

Catalogued exploits

ExploitDBHUSTOJ Zip-Slip v26.01.24 - RCEExploitDB exploitby Marshall WhittakerExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2026-24479, a Zip-Slip vulnerability in HUSTOJ. It authenticates as an admin, uploads a crafted ZIP archive containing path traversal sequences to write a PHP shell and an ELF payload to the web root and /tmp, then triggers the PHP shell to execute the payload, achieving remote code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied Metasploit module implements a documented Zip-Slip RCE exploit for CVE-2026-24479. It authenticates to a HUSTOJ instance, uploads a crafted ZIP containing a Metasploit-generated payload and PHP caller, and triggers execution. All actions are consistent with the stated exploit purpose; no concealed backdoor, unrelated payload, or operator-directed harm is observed.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesRuby
Target softwareHUSTOJ
Attack typesRemote Code ExecutionPath TraversalZip Slip
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit module that actively exploits CVE-2026-24479 by authenticating, uploading a crafted ZIP with path traversal to write a PHP shell and ELF payload, and triggering the shell to execute the payload for remote code execution. It is not a scanner, writeup, or stub.

exploits/multiple/webapps/52539.rb:1-371

Requirements

  • Valid administrative credentials for the HUSTOJ target.exploits/multiple/webapps/52539.rb:105-106
  • Target HUSTOJ version prior to 26.01.24.exploits/multiple/webapps/52539.rb:85

Observed behavior

  • Authenticates to the HUSTOJ web application using provided admin credentials.exploits/multiple/webapps/52539.rb:138-222
  • Generates an ELF payload (e.g., Meterpreter reverse TCP) and a PHP shell caller script.exploits/multiple/webapps/52539.rb:328-349
  • Creates a malicious ZIP archive containing files with directory traversal sequences (e.g., ../../tmp/...) to write the ELF payload and PHP shell outside the intended extraction directory.exploits/multiple/webapps/52539.rb:350-361
  • Uploads the malicious ZIP archive via a multipart POST request to /admin/problem_import_qduoj.php.exploits/multiple/webapps/52539.rb:225-296
  • Triggers the dropped PHP shell by sending a GET request to the web root, which executes the ELF payload and establishes a reverse shell.exploits/multiple/webapps/52539.rb:299-309
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThe module logs in as admin, uploads a ZIP with path traversal to write a PHP shell and ELF payload, then triggers the shell. This matches the CVE description and module purpose.exploits/multiple/webapps/52539.rb:326-370
Payload Generation
Payload withheldThe exploit generates the payload via framework.modules.create and generate_simple, using user-supplied LHOST/LPORT. No hardcoded backdoor payload is present.exploits/multiple/webapps/52539.rb:328-338
Cleanup Mechanism
Payload withheldThe module includes a cleanup_caller PHP script that deletes the dropped ELF and PHP files, and a cleanup method that triggers it. This is a standard post-exploitation cleanup, not a backdoor.exploits/multiple/webapps/52539.rb:312-323exploits/multiple/webapps/52539.rb:348-349
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the supplied Metasploit module source code; no external dependencies, libraries, or referenced resources were expanded or analyzed.
  • The artifact's behavior is inferred from static code analysis; the code was not executed, and its operational reliability or safety is not assessed.
  • Only the Metasploit module source code was reviewed; the generated payload binary and the Metasploit framework's internal payload generation are not included in the evidence.
  • The review does not assess the safety or reliability of the exploit against legitimate targets.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

MetasploitHUSTOJ Admin users can zip-slip problem_import_qduoj.php, planting PHP files in webroot for RCEMetasploit exploitby LoTuS and friends +2 moreExploit1 file

Ruby

Metasploit
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2026-24479 in HUSTOJ. It authenticates as an admin, uploads a crafted ZIP archive containing path traversal sequences to write a PHP web shell and an ELF payload to the server, then triggers the PHP shell to execute the payload for remote code execution.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit exploit for CVE-2026-24479. It authenticates to HUSTOJ, uploads a crafted ZIP archive containing a path-traversal payload (ELF) and a PHP caller, then triggers the PHP to execute the payload. All behavior is consistent with the described exploit and contains no concealed backdoor, credential exfiltration, persistence, or unrelated payload delivery.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesRuby
Target softwareHUSTOJ
Attack typesRemote Code ExecutionPath TraversalZip Slip
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises the vulnerability by authenticating, uploading a crafted zip-slip payload, and executing arbitrary code on the target. It includes full logic for payload generation, delivery, and triggering, which is the definition of an exploit.

modules/exploits/linux/http/hustoj_problem_import_rce.rb:196-250

Requirements

  • Valid administrative credentials for the HUSTOJ instance.modules/exploits/linux/http/hustoj_problem_import_rce.rb:58-59
  • Target must be running a vulnerable version of HUSTOJ (prior to 26.01.24).modules/exploits/linux/http/hustoj_problem_import_rce.rb:99-100

Observed behavior

  • Authenticates to the HUSTOJ web application using provided username and MD5-hashed password.modules/exploits/linux/http/hustoj_problem_import_rce.rb:108-117
  • Generates an ELF payload and a PHP caller script, then packages them into a ZIP archive with directory traversal paths (e.g., ../../tmp/...) to exploit a zip-slip vulnerability.modules/exploits/linux/http/hustoj_problem_import_rce.rb:220-232
  • Uploads the malicious ZIP file to /admin/problem_import_qduoj.php, causing the server to extract the PHP shell into the webroot and the ELF payload into /tmp.modules/exploits/linux/http/hustoj_problem_import_rce.rb:144-165
  • Triggers the dropped PHP shell via an HTTP GET request, which executes the ELF payload to establish a reverse shell or other session.modules/exploits/linux/http/hustoj_problem_import_rce.rb:168-180
  • Cleans up dropped files by requesting a cleanup PHP script.modules/exploits/linux/http/hustoj_problem_import_rce.rb:183-193
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload Generation
Payload withheldUses the standard Metasploit payload generation API to create the ELF payload that will be executed on the target.modules/exploits/linux/http/hustoj_problem_import_rce.rb:204
Php Caller
Payload withheldThe PHP script planted in the webroot executes the uploaded ELF payload. This is the standard RCE mechanism for the exploit.modules/exploits/linux/http/hustoj_problem_import_rce.rb:216
Cleanup Mechanism
Payload withheldThe module includes a cleanup routine that deletes the dropped ELF and PHP files from the target, which is a normal post-exploitation hygiene practice.modules/exploits/linux/http/hustoj_problem_import_rce.rb:183-193modules/exploits/linux/http/hustoj_problem_import_rce.rb:218-219
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the provided module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The artifact was not executed, so its operational reliability or safety is not assessed.
  • Only the module source file was reviewed; Metasploit framework mixins, libraries, and the generated payload itself are not expanded or analyzed.
  • Binary content of the generated ZIP and ELF payload is not inspected; the review assumes the standard Metasploit payload generation behaves as documented.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2