Vulnerability Report

CVE-2026-25057

Title: Path traversal in MarkUs assignment zip upload

Arbitrary File Access

Proof Of Concept

PoC Available for CVE-2026-25057

CWE Category CWE-23

Published Date Feb 09, 2026

Modified Date Feb 19, 2026

Exploit Status Available

Score 9.1 CVSS v3.1

Exploit Probability (EPSS)

0.48%

Vulnerability Summary

CVE-2026-25057: MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration (courses/<:course_id>/assignments/upload_config_files). The uploaded zip file entry names are used to create paths to write files to disk without checking these paths. This vulnerability is fixed in 2.9.1.

Impacted Vendors

markusproject 1

Reference Links

https://github.com/MarkUsProject/Markus/commit/0ca002a1f0071c7a00dbb2ed34fede57323c5dc7 https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1 https://github.com/MarkUsProject/Markus/security/advisories/GHSA-mccg-p332-252h

CVSS v3.1

Source Entity [email protected]

Severity CRITICAL

9.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-25057 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/ibrah-m/CVE-2026-25057

View Code

February 19, 2026 MODIFIED

Vulnerability data updated via NVD.

February 19, 2026 MODIFIED

Vulnerability data updated via NVD.

February 09, 2026 MODIFIED

Vulnerability data updated via NVD.

February 09, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected Stack

No specific products linked.