CVE-2026-25057
CRITICALMarkus < 2.9.1 - Path Traversal via Assignment Configuration Upload
Title source: llmDescription
MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration (courses/<:course_id>/assignments/upload_config_files). The uploaded zip file entry names are used to create paths to write files to disk without checking these paths. This vulnerability is fixed in 2.9.1.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_confirm
https://github.com/MarkUsProject/Markus/security/advisories/GHSA-mccg-p332-252h
Patch x_refsource_misc
https://github.com/MarkUsProject/Markus/commit/0ca002a1f0071c7a00dbb2ed34fede57323c5dc7
Release Notes x_refsource_misc
https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1
Scores
CVSS v3
9.1
EPSS
0.0047
EPSS Percentile
36.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-23
Status
published
Products (1)
markusproject/markus
< 2.9.1
Published
Feb 09, 2026
Tracked Since
Feb 18, 2026