PT-2026-7132 · Markus · Markus

Ibrah-M + 2 · Publicado 2026-02-09 · Atualizado 2026-02-10 · CVE-2026-25057

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MarkUs versions prior to 2.9.1

Description MarkUs is a web application used for submitting and grading student assignments. Prior to version 2.9.1, instructors could upload a zip file to create an assignment from an exported configuration via the /courses/<:course id>/assignments/upload config files API endpoint. The application does not properly validate the file names within the uploaded zip file before using them to create file paths, potentially allowing for malicious paths to be written to disk.

Recommendations Update to version 2.9.1 or later.

Exploit

Correção

RCE

Relative Path Traversal

Enumeração de Fraquezas

CWE-23

Identificadores relacionados

CVE-2026-25057

GHSA-MCCG-P332-252H

Produtos afetados

Markus

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25057.json · Exploit
• https://github.com/MarkUsProject/Markus/security/advisories/GHSA-mccg-p332-252h · Aviso do Fabricante
• https://github.com/MarkUsProject/Markus/commit/0ca002a1f0071c7a00dbb2ed34fede57323c5dc7 · Correção
• https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1 · Nota
• https://twitter.com/CVEnew/status/2020959696203448602 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-25057 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25057 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2020956558226751738 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2020999034417070290 · Publicação no Twitter
• https://twitter.com/pulsepatchio/status/2021241235130941658 · Publicação no Twitter