{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/markusproject/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:markusproject:markus:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-25057"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MarkUs (\u003c 2.9.1)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","rce","path-traversal","zip-slip"],"_cs_type":"advisory","_cs_vendors":["MarkUsProject"],"content_html":"\u003cp\u003eMarkUs, a web-based assignment grading application, is vulnerable to a Zip Slip path traversal vulnerability (CVE-2026-25057). The vulnerability exists in the assignment configuration ZIP upload functionality, where archive entry names are used to build filesystem paths without proper validation. An authenticated user with instructor privileges can upload a crafted ZIP file containing traversal sequences to overwrite files on the underlying host, potentially leading to remote code execution (RCE).\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eActor authenticates to the MarkUs web interface with instructor-level privileges.\u003c/li\u003e\n\u003cli\u003eActor navigates to the 'Assignments' section of a course.\u003c/li\u003e\n\u003cli\u003eActor selects the 'Upload the configuration zip file' option.\u003c/li\u003e\n\u003cli\u003eActor submits a specially crafted ZIP archive containing malicious file paths with traversal sequences.\u003c/li\u003e\n\u003cli\u003eThe application extracts the archive, writing files outside the intended destination directory.\u003c/li\u003e\n\u003cli\u003eThe application overwrites a critical executable or configuration file, enabling subsequent remote command execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary file writes with the privileges of the web application process. This may lead to total compromise of the server if the attacker can overwrite executable application files or startup scripts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all instances of MarkUs in the environment.\u003c/li\u003e\n\u003cli\u003eApply security patches provided by the MarkUsProject as soon as they are available.\u003c/li\u003e\n\u003cli\u003eAudit logs for 'Assignments' configuration file upload activity, particularly by instructor-level accounts.\u003c/li\u003e\n\u003cli\u003eImplement restrictive filesystem permissions for the web application user to limit the impact of potential file overwrite attacks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T01:03:26Z","date_published":"2026-10-31T01:03:26Z","id":"https://feed.craftedsignal.io/briefs/2026-10-markus-zip-slip/","summary":"An authenticated instructor-level user can exploit a Zip Slip vulnerability in MarkUs assignment configuration uploads to write arbitrary files and achieve remote code execution.","title":"MarkUs: Zip Slip remote code execution (CVE-2026-25057)","url":"https://feed.craftedsignal.io/briefs/2026-10-markus-zip-slip/"}],"language":"en","title":"CraftedSignal Threat Feed - MarkUsProject","version":"https://jsonfeed.org/version/1.1"}