Markusproject Markus vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Markusproject Markus: 5 record(s), with affected versions and fixes.cpe:2.3:a:markusproject:markus
CVE-2026-27807
Medium · 4.9
CWE-776 Mar 6, 2026
MarkUs: YAML alias (‘billion laughs’) DoS in config upload
MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows course instructors to upload YAML files to create/update various entities (e.g., assignment settings). These YAML files are parsed with aliases enabled. This issue has been patched in version 2.9.4.
CVE-2026-25962
Medium · 6.5
CWE-409 Mar 6, 2026
MarkUs: Zip bomb in config upload enables DoS
MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs currently extracts zip files without any size or entry-count limits. For example, instructors can upload a zip file to provide an assignment configuration; students can upload a zip file for an assignment submission and indicate its contents should be extracted. This issue has been patched in version 2.9.4.
CVE-2026-28405
Medium · 5.4
CWE-79 Mar 5, 2026
MarkUs: Stored XSS in Submission HTML Preview Enables Instructor-Context Actions
MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.1, the courses/<:course_id>/assignments/<:assignment_id>/submissions/html_content route reads the contents of a student-submitted file and renders them without sanitization. This issue has been patched in version 2.9.1.
CVE-2026-25057
Critical · 9.1
CWE-23 Feb 9, 2026
Zip Slip in MarkUs config upload allowing RCE
MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration (courses/<:course_id>/assignments/upload_config_files). The uploaded zip file entry names are used to create paths to write files to disk without checking these paths. This vulnerability is fixed in 2.9.1.
CVE-2026-24900
Medium · 6.5
CWE-639 Feb 9, 2026
MarkUs has a submission-view IDOR exposes all student submissions
MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses/<:course_id>/assignments/<:assignment_id>/submissions/html_content accepted a select_file_id parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correctly scoped to the requesting user, allowing users access arbitrary submission file contents by id. This vulnerability is fixed in 2.9.1.