PT-2026-4839 · Linux+3 · Linux+3

Ling101W · Published 2026-01-27 · Updated 2026-05-22 · CVE-2026-24479

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HUSTOF versions prior to 26.01.24

Description HUSTOF is an online judge system built on PHP, C++, MySQL, and Linux. A path traversal flaw exists in the problem import qduoj.php and problem import hoj.php modules when handling ZIP archive extractions. This allows attackers to write files to arbitrary locations within the web root by crafting malicious ZIP files containing path traversal sequences, such as ../../shell.php. Successful exploitation leads to Remote Code Execution (RCE).

Recommendations Versions prior to 26.01.24 should be updated to version 26.01.24 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-24479

GHSA-XMGG-2RW4-7FXJ

Affected Products

Hustof

Linux

Mysql Server

Php

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24479.json · Exploit
• 🔥 https://exploit-db.com/exploits/52539 · Exploit
• https://github.com/zhblue/hustoj/security/advisories/GHSA-xmgg-2rw4-7fxj · Vendor Advisory
• https://github.com/zhblue/hustoj/commit/902bd09e6d0011fe89cd84d4236899314b33101f · Patch
• https://osv.dev/vulnerability/CVE-2026-24479 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24479 · Security Note
• https://t.me/cveNotify/149942 · Telegram Post
• https://twitter.com/0dayPublishing/status/2015951972113711357 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1tkubur/metasploit_wrap_up_05222026 · Reddit Post
• https://t.me/cveNotify/153841 · Telegram Post
• https://twitter.com/CVEnew/status/2015988784878219371 · Twitter Post
• https://t.me/CVEtracker/43032 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2016000247273517271 · Twitter Post