CVE-2026-25057: MarkUs Zip Slip path traversal in config upload
MarkUs, a web application for submitting and grading student assignments, is affected by a Zip Slip path traversal in its assignment configuration upload. According to the record, instructors can upload a zip file whose entry names are used to build disk write paths without validation, and the issue is fixed in 2.9.1. The record assigns a CVSS score of 9.1 (critical), and its title associates the flaw with remote code execution.
Overview
MarkUs is a web application for submitting and grading student assignments. The record describes a Zip Slip issue (CWE-23, relative path traversal) in the assignment configuration upload feature. Entry names inside an uploaded zip archive are used to build file write paths without checking them.
Impact
- The CVSS vector in the record indicates high confidentiality, integrity and availability impact, with a changed scope. The base score is 9.1.
- The record title associates the flaw with remote code execution. The description itself does not state that impact explicitly.
- Writing files outside the intended directory is the direct consequence of the behavior described (inference).
Affected products and versions
- Product: Markusproject Markus.
- Affected versions: before 2.9.1.
- Fixed version: 2.9.1, according to the record and the release reference.
Exploitation status
This CVE is not listed in CISA KEV. The SSVC data in the record shows exploitation as none and automatable as no, and the EPSS probability is 0.00533. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Upgrade MarkUs to 2.9.1 or a later release that includes the fix.
- Review the patch commit and release notes linked in the references.
- Until the upgrade is done, limit configuration upload to trusted instructors and reduce the number of accounts that can use this feature (inference, not stated by the sources).
- Restrict the file system permissions of the application account so it can write only to directories it needs.
Detection guidance
- Review logs for configuration uploads, especially archives with unusual entry names or path traversal sequences.
- Look for files created or modified outside the expected application data directories after upload activity.
- Monitor for unexpected changes in application code or web-accessible paths.
Limitations of the available information
The record does not include technical details of the exploit path, a proof of concept, or a description of the RCE scenario. The affected range is given only as before 2.9.1, without a lower bound. The EPSS date in the record (2026-10-23) is later than the publication date, so it should be treated with caution.
Frequently asked questions
What is the vulnerability in MarkUs?
According to the record, MarkUs uses entry names from an uploaded zip file to build file write paths without validating them, which is a Zip Slip path traversal (CWE-23). The issue is in the assignment configuration upload feature.
Which version fixes it?
The record states that the issue is fixed in 2.9.1, and the affected range is listed as before 2.9.1. Upgrading to 2.9.1 or later is the recommended step.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.