Critical severity9.1NVD Advisory· Published Sep 4, 2026· Updated Sep 23, 2026

CVE-2026-85684

Description

marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existing files on the system.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Datalab To/markerllm-fuzzy
Range: <=2.0.0

Patches

Vulnerability mechanics

References

github.com/datalab-to/marker/blob/v2.0.0/marker/scripts/server.pynvd
github.com/datalab-to/marker/issues/1047nvd
www.vulncheck.com/advisories/marker-through-2.0.0-path-traversal-via-upload-filenamenvd

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000