PT-2026-7132 · Markus · Markus

Ibrah-M + 2 · Published 2026-02-09 · Updated 2026-02-10 · CVE-2026-25057

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MarkUs versions prior to 2.9.1

Description MarkUs is a web application used for submitting and grading student assignments. Prior to version 2.9.1, instructors could upload a zip file to create an assignment from an exported configuration via the /courses/<:course id>/assignments/upload config files API endpoint. The application does not properly validate the file names within the uploaded zip file before using them to create file paths, potentially allowing for malicious paths to be written to disk.

Recommendations Update to version 2.9.1 or later.

Exploit

Fix

RCE

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2026-25057

GHSA-MCCG-P332-252H

Affected Products

Markus

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25057.json · Exploit
• https://github.com/MarkUsProject/Markus/security/advisories/GHSA-mccg-p332-252h · Vendor Advisory
• https://github.com/MarkUsProject/Markus/commit/0ca002a1f0071c7a00dbb2ed34fede57323c5dc7 · Patch
• https://osv.dev/vulnerability/CVE-2026-25057 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25057 · Security Note
• https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1 · Note
• https://twitter.com/CVEnew/status/2020959696203448602 · Twitter Post
• https://twitter.com/TheHackerWire/status/2020956558226751738 · Twitter Post
• https://twitter.com/CveFindCom/status/2020999034417070290 · Twitter Post
• https://twitter.com/pulsepatchio/status/2021241235130941658 · Twitter Post