VYPR
← All advisories
Critical severity9.1NVD Advisory· Published Feb 9, 2026· Updated Jun 17, 2026

CVE-2026-25057

CVE-2026-25057

Description

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration (courses/<:course_id>/assignments/upload_config_files). The uploaded zip file entry names are used to create paths to write files to disk without checking these paths. This vulnerability is fixed in 2.9.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • MarkUsProject/Markuscpe-rescue3 versions
    < 2.9.1+ 2 more
    • (no CPE)range: < 2.9.1
    • cpe:2.3:a:markusproject:markus:*:*:*:*:*:*:*:*range: <2.9.1
    • (no CPE)range: <2.9.1

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.