PT-2026-23627 · Markus · Markus

Ibrah-M + 1 · Published 2026-03-06 · Updated 2026-03-12 · CVE-2026-25962

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MarkUs versions prior to 2.9.4

Description MarkUs is a web application used for submitting and grading student assignments. Before version 2.9.4, the application extracted zip files without limitations on file size or the number of entries within the archive. This allowed instructors to upload zip files for assignment configurations and students to submit assignments as zip files, with the contents being extracted by the application.

Recommendations Update to version 2.9.4 or later.

Exploit

Fix

Weakness Enumeration

CWE-409

Related Identifiers

CVE-2026-25962

GHSA-X8XV-J7FC-65X5

Affected Products

Markus

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25962.json · Exploit
• https://github.com/MarkUsProject/Markus/security/advisories/GHSA-x8xv-j7fc-65x5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25962 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25962 · Security Note
• https://github.com/MarkUsProject/Markus/releases/tag/v2.9.4 · Note
• https://t.me/cveNotify/155317 · Telegram Post