PT-2026-23628 · Markus · Markus

Ibrah-M + 1 · Publicado 2026-03-06 · Atualizado 2026-03-12 · CVE-2026-27807

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MarkUs versions prior to 2.9.4

Description MarkUs is a web application used for submitting and grading student assignments. Versions of MarkUs before 2.9.4 allow course instructors to upload YAML files to create or update entities like assignment settings. The application parses these YAML files with aliases enabled, which can lead to issues. This issue was addressed in version 2.9.4. YAML aliases allow defining reusable parts within a YAML file, potentially leading to unintended consequences if not handled securely during parsing.

Recommendations Update to version 2.9.4 or later.

Exploit

Correção

XML Entity Expansion

Enumeração de Fraquezas

CWE-776

Identificadores relacionados

CVE-2026-27807

GHSA-M9RX-85MX-Q9H6

Produtos afetados

Markus

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27807.json · Exploit
• https://github.com/MarkUsProject/Markus/releases/tag/v2.9.4 · Nota
• https://github.com/MarkUsProject/Markus/security/advisories/GHSA-m9rx-85mx-q9h6 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-27807 · Nota de Segurança
• https://t.me/cveNotify/155318 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-27807 · Aviso do Fabricante