Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-25057
PUBLISHED
More InfoOfficial Page
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
View Known Exploited Vulnerability (KEV) details
Published At-09 Feb, 2026 | 19:16
Updated At-10 Feb, 2026 | 16:00
Rejected At-
▼CVE Numbering Authority (CNA)
Zip Slip in MarkUs config upload allowing RCE

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration (courses/<:course_id>/assignments/upload_config_files). The uploaded zip file entry names are used to create paths to write files to disk without checking these paths. This vulnerability is fixed in 2.9.1.

Affected Products
Vendor
MarkUsProject
Product
Markus
Versions
Affected
  • < 2.9.1
Problem Types
TypeCWE IDDescription
CWECWE-23CWE-23: Relative Path Traversal
Type: CWE
CWE ID: CWE-23
Description: CWE-23: Relative Path Traversal
Metrics
VersionBase scoreBase severityVector
3.19.1CRITICAL
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Version: 3.1
Base score: 9.1
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/MarkUsProject/Markus/security/advisories/GHSA-mccg-p332-252h
x_refsource_CONFIRM
https://github.com/MarkUsProject/Markus/commit/0ca002a1f0071c7a00dbb2ed34fede57323c5dc7
x_refsource_MISC
https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1
x_refsource_MISC
Hyperlink: https://github.com/MarkUsProject/Markus/security/advisories/GHSA-mccg-p332-252h
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/MarkUsProject/Markus/commit/0ca002a1f0071c7a00dbb2ed34fede57323c5dc7
Resource:
x_refsource_MISC
Hyperlink: https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1
Resource:
x_refsource_MISC
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found