Skip to content
Threat Feed
Subscribe
high advisory

MarkUs: Zip Slip remote code execution (CVE-2026-25057)

An authenticated instructor-level user can exploit a Zip Slip vulnerability in MarkUs assignment configuration uploads to write arbitrary files and achieve remote code execution.

CVE search metadata

CVE search record: CVE-2026-25057. Severity: critical. CVSS: 9.1. EPSS: 0.53%. KEV: no. Product: MarkUs (< 2.9.1). Brief: MarkUs: Zip Slip remote code execution (CVE-2026-25057). Brief link: https://feed.craftedsignal.io/briefs/2026-10-markus-zip-slip/

Triage facts

Revision 1
Applicability
MarkUs (< 2.9.1)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Oct 31, 01:03 UTC
Vulnerabilities
1 CVE
Source quality
C3Likely

MarkUs, a web-based assignment grading application, is vulnerable to a Zip Slip path traversal vulnerability (CVE-2026-25057). The vulnerability exists in the assignment configuration ZIP upload functionality, where archive entry names are used to build filesystem paths without proper validation. An authenticated user with instructor privileges can upload a crafted ZIP file containing traversal sequences to overwrite files on the underlying host, potentially leading to remote code execution (RCE).

Attack Chain

  1. Actor authenticates to the MarkUs web interface with instructor-level privileges.
  2. Actor navigates to the 'Assignments' section of a course.
  3. Actor selects the 'Upload the configuration zip file' option.
  4. Actor submits a specially crafted ZIP archive containing malicious file paths with traversal sequences.
  5. The application extracts the archive, writing files outside the intended destination directory.
  6. The application overwrites a critical executable or configuration file, enabling subsequent remote command execution.

Impact

Successful exploitation allows for arbitrary file writes with the privileges of the web application process. This may lead to total compromise of the server if the attacker can overwrite executable application files or startup scripts.

Recommendation

  • Inventory all instances of MarkUs in the environment.
  • Apply security patches provided by the MarkUsProject as soon as they are available.
  • Audit logs for 'Assignments' configuration file upload activity, particularly by instructor-level accounts.
  • Implement restrictive filesystem permissions for the web application user to limit the impact of potential file overwrite attacks.

Immediate actions

Identify all MarkUs deployments and restrict access to the configuration upload functionality to known, authorized instructor accounts.

IT Operations 24h

Threat Hunt

Identify unusual file system writes within the MarkUs application directory, specifically following requests to the assignment configuration upload endpoint.

T1059 high medium confidence hunt now

Data: Web server access logs (cs-uri-stem), File integrity monitoring (FIM) or OS-level file creation events

Mitigations

Patch MarkUs to 2.9.1 or later

immediate IT Operations

CVE-2026-25057