Cpe:2.3:a:markusproject:markus:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amarkusprojectmarkus/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 01:03:26 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMarkUs: Zip Slip remote code execution (CVE-2026-25057)https://feed.craftedsignal.io/briefs/2026-10-markus-zip-slip/Sat, 31 Oct 2026 01:03:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-markus-zip-slip/An authenticated instructor-level user can exploit a Zip Slip vulnerability in MarkUs assignment configuration uploads to write arbitrary files and achieve remote code execution.MarkUs, a web-based assignment grading application, is vulnerable to a Zip Slip path traversal vulnerability (CVE-2026-25057). The vulnerability exists in the assignment configuration ZIP upload functionality, where archive entry names are used to build filesystem paths without proper validation. An authenticated user with instructor privileges can upload a crafted ZIP file containing traversal sequences to overwrite files on the underlying host, potentially leading to remote code execution (RCE).

Attack Chain

  1. Actor authenticates to the MarkUs web interface with instructor-level privileges.
  2. Actor navigates to the 'Assignments' section of a course.
  3. Actor selects the 'Upload the configuration zip file' option.
  4. Actor submits a specially crafted ZIP archive containing malicious file paths with traversal sequences.
  5. The application extracts the archive, writing files outside the intended destination directory.
  6. The application overwrites a critical executable or configuration file, enabling subsequent remote command execution.

Impact

Successful exploitation allows for arbitrary file writes with the privileges of the web application process. This may lead to total compromise of the server if the attacker can overwrite executable application files or startup scripts.

Recommendation

  • Inventory all instances of MarkUs in the environment.
  • Apply security patches provided by the MarkUsProject as soon as they are available.
  • Audit logs for 'Assignments' configuration file upload activity, particularly by instructor-level accounts.
  • Implement restrictive filesystem permissions for the web application user to limit the impact of potential file overwrite attacks.
]]>highadvisoryweb-vulnerabilityrcepath-traversalzip-slip